Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix use after free in callbacks with results. #616

Open
wants to merge 3 commits into
base: master
Choose a base branch
from

Conversation

gmsoft-tuxicoman
Copy link

There is a use-after-free bug in menu state change callback.

in line CECClient.cpp:1656, cb->m_keepResult is check to find out if the callbackWrap needs to be deleted or not.
However in CCECClient::QueueMenuStateChanged, the callback is deleted right after Result().

By the time Report() finishes, the callback is already delted and thus the value if cb->m_keepResult should not be access and can become 0 leading to a double free.

@ahwayakchih
Copy link

ahwayakchih commented Aug 19, 2024

I've noticed following in my application, which i think may be caused by error that this patch fixes:

free(): double free detected in tcache 2

It happens randomly (well... at least i could not find out exact case when it happens) after menu button on remote controller is used. Last time it happened:

[on_logMessage 3281] >> TV (0) -> Recorder 1 (1): menu request (8D), 16, 8844
[on_logMessage 3281] >> menu request: deactivated, 16, 8844
free(): double free detected in tcache 2

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants