Segfault when using callbacks
A Python module to control the GPIO on a Raspberry Pi
Brought to you by:
croston
The following causes a use-after-free bug:
RPi.GPIO.add_event_detect (channel, edge, callback = RPi.GPIO.remove_event_detect)
Look at the function run_py_callbacks starting at line 586 of source/py_gpio.c In the example given above, calling the callback in line 597 causes the memory pointed to by cb to be freed. If it is overwritten before line 605 (cb = cb->next), then cb goes into hyperspace and a segfault follows.