Commit: 9a6a84a8a2b9336c2cdb943146207cb8a5a5260c
Parent: 8562d0e3874ef8801d1f69d3c024611da33f9220
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Committer: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: 2024-09-16 23:23:16
Tree: 3c6244b9a56a4c7da05a7dd43da1a2f73081589f

shared/uhid: Fix crash after bt_uhid_unregister_all This fixes the following crash which happens when bt_uhid_unregister_all is called from a notification callback: Invalid read of size 8 at 0x1D9EFF: queue_foreach (queue.c:206) by 0x1DEE58: uhid_read_handler (uhid.c:164) Address 0x51286d8 is 8 bytes inside a block of size 16 free'd at 0x48478EF: free (vg_replace_malloc.c:989) by 0x1DA08D: queue_remove_if (queue.c:292) by 0x1DA12F: queue_remove_all (queue.c:321) by 0x1DE592: bt_uhid_unregister_all (uhid.c:300) Fixes: https://github.com/bluez/bluez/issues/952

Diffstat

M src/shared/uhid.c | 47 ++++++++++++++++++++++++++++++++++++++++- - -

1 files changed, 44 insertions(+), 3 deletions(-)

View Full Diff | Patch