Hello:
This patch was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>:
On Mon, 17 Jun 2024 20:11:53 +0300 you wrote:
> Fix UAF by freeing transport->remote_endpoint in media_transport_free,
> which also frees the struct (not in destroy after the struct is freed).
>
> ERROR: AddressSanitizer: heap-use-after-free
> READ of size 8 at 0x508000022ab8 thread T0
> #0 0x493624 in media_transport_destroy profiles/audio/transport.c:223
> ...
> freed by thread T0 here:
> #1 0x7fb057d10294 in g_free (/lib64/libglib-2.0.so.0+0x5d294)
> #2 0x49dd2d in media_transport_free profiles/audio/transport.c:1276
> #3 0x7e0e99 in remove_interface gdbus/object.c:682
> #4 0x7e8f40 in g_dbus_unregister_interface gdbus/object.c:1430
> #5 0x4935a2 in media_transport_destroy profiles/audio/transport.c:220
>
> [...]
Here is the summary with links:
- [BlueZ] transport: fix crash when freeing transport
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=87ad4c66b934
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
