[Bluez V2 10/13] Fixing use after free in src/device.c

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



From: Gopal Tiwari <gtiwari@xxxxxxxxxx>

Following traces reported by covirty tool

Error: USE_AFTER_FREE (CWE-416):
bluez-5.64/src/device.c:2962: path: Condition 
"!dbus_message_get_args(msg, NULL, 0 /* (int)0 */)", taking false branch.

bluez-5.64/src/device.c:2965: path: 
Condition "device->bonding", taking false branch.

bluez-5.64/src/device.c:2968: path: 
Condition "device->bredr_state.bonded", taking true branch.

bluez-5.64/src/device.c:2969: path: Falling through to end of 
if statement.

bluez-5.64/src/device.c:2977: path: Condition "state->bonded", 
taking false branch.

bluez-5.64/src/device.c:2983: path: Condition "agent", taking 
true branch.

bluez-5.64/src/device.c:2984: path: Falling through to end of 
if statement.

bluez-5.64/src/device.c:2990: path: Condition "agent", taking 
true branch.

bluez-5.64/src/device.c:3005: path: Condition "bdaddr_type != 0", 
taking true branch.

bluez-5.64/src/device.c:3006: path: 

Condition "!state->connected", taking true branch.

bluez-5.64/src/device.c:3006: path: 
Condition "btd_le_connect_before_pairing()", taking true branch.
bluez-5.64/src/device.c:3007: freed_arg: "device_connect_le" frees 
"device->bonding".

bluez-5.64/src/device.c:3007: path: Falling through to end of 
if statement.

bluez-5.64/src/device.c:3012: path: Falling through to end of 
if statement.

bluez-5.64/src/device.c:3017: path: Condition "err < 0", 
taking true branch.

bluez-5.64/src/device.c:3018: double_free: Calling "bonding_request_free" 
frees pointer "device->bonding" which has already been freed.

Signed-off-by: Gopal Tiwari <gtiwari@xxxxxxxxxx>
---
 src/device.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/device.c b/src/device.c
index 8dc12d026..a0e5d40db 100644
--- a/src/device.c
+++ b/src/device.c
@@ -2942,6 +2942,7 @@ static void bonding_request_free(struct bonding_req *bonding)
 		bonding->device->bonding = NULL;
 
 	g_free(bonding);
+	bonding = NULL;
 }
 
 static DBusMessage *pair_device(DBusConnection *conn, DBusMessage *msg,
-- 
2.26.2




[Index of Archives]     [Bluez Devel]     [Linux Wireless Networking]     [Linux Wireless Personal Area Networking]     [Linux ATH6KL]     [Linux USB Devel]     [Linux Media Drivers]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Big List of Linux Books]

  Powered by Linux