Blame SOURCES/0012-mesh-gatt-Fix-use_after_free.patch
|
 |
150e62 |
From 5cdaeaefc350ea3c42719284b88406579d032fb6 Mon Sep 17 00:00:00 2001
|
|
|
150e62 |
From: Gopal Tiwari <gtiwari@redhat.com>
|
|
|
150e62 |
Date: Tue, 31 May 2022 13:11:17 +0530
|
|
|
150e62 |
Subject: [PATCH BlueZ 12/12] mesh-gatt: Fix use_after_free
|
|
|
150e62 |
|
|
|
150e62 |
Following scenario happens when prov is false and we have double free as
|
|
|
150e62 |
mentioned in the below
|
|
|
150e62 |
|
|
|
150e62 |
bluez-5.64/tools/mesh-gatt/prov-db.c:847: freed_arg: "g_free" frees
|
|
|
150e62 |
"in_str".
|
|
|
150e62 |
|
|
|
150e62 |
bluez-5.64/tools/mesh-gatt/prov-db.c:867: double_free: Calling "g_free"
|
|
|
150e62 |
frees pointer "in_str" which has already been freed.
|
|
|
150e62 |
---
|
|
|
150e62 |
tools/mesh-gatt/prov-db.c | 3 ++-
|
|
|
150e62 |
1 file changed, 2 insertions(+), 1 deletion(-)
|
|
|
150e62 |
|
|
|
150e62 |
diff --git a/tools/mesh-gatt/prov-db.c b/tools/mesh-gatt/prov-db.c
|
|
|
150e62 |
index 2fb08f799..a5b6997e0 100644
|
|
|
150e62 |
--- a/tools/mesh-gatt/prov-db.c
|
|
|
150e62 |
+++ b/tools/mesh-gatt/prov-db.c
|
|
|
150e62 |
@@ -859,7 +859,8 @@ bool prov_db_local_set_iv_index(uint32_t iv_index, bool update, bool prov)
|
|
|
150e62 |
|
|
|
150e62 |
set_local_iv_index(jmain, iv_index, update);
|
|
|
150e62 |
prov_file_write(jmain, false);
|
|
|
150e62 |
- }
|
|
|
150e62 |
+ } else
|
|
|
150e62 |
+ return true;
|
|
|
150e62 |
|
|
|
150e62 |
res = true;
|
|
|
150e62 |
done:
|
|
|
150e62 |
--
|
|
|
150e62 |
2.26.2
|
|
|
150e62 |
|