Opened 8 years ago

Closed 8 years ago

#13185 closed bug (fixed)

[Patch] add-ons/kernel/drivers/common/usb_modeswitch.cpp: fix use after free.

Reported by: mt Owned by: mmlr
Priority: normal Milestone: Unscheduled
Component: Drivers/USB Version: R1/Development
Keywords: Cc:
Blocked By: Blocking:
Platform: All

Description

At line 538 [1], my_device_added() uses address which is freed at line 537 [2].

[1] ​http://cgit.haiku-os.org/haiku/tree/src/add-ons/kernel/drivers/common/usb_modeswitch.cpp#n538 [2] ​http://cgit.haiku-os.org/haiku/tree/src/add-ons/kernel/drivers/common/usb_modeswitch.cpp#n537

Change History (5)

by mt, 8 years ago

Attachment: 0039-usb_modeswitch.cpp-fix-use-after-free.patch​ added

comment:1 by mt, 8 years ago

patch: 0 → 1

by mt, 8 years ago

Attachment: report-edf6bb.html​ added

Report by Clang Static Analyzer

comment:2 by korli, 8 years ago

1/ drop the else 2/ "id" isn't a nice name, for instance notifySemId is better.

comment:3 by pulkomandy, 8 years ago

Resolution: → fixed
Status: new → closed

Applied in hrev50868, and Korli's suggested changes in hrev50869.

Note: See TracTickets for help on using tickets.