Opened 7 years ago

Closed 7 years ago

#13185 closed bug (fixed)

[Patch] add-ons/kernel/drivers/common/usb_modeswitch.cpp: fix use after free.

Reported by: mt Owned by: mmlr
Priority: normal Milestone: Unscheduled
Component: Drivers/USB Version: R1/Development
Keywords: Cc:
Blocked By: Blocking:
Platform: All

Description

At line 538 [1], my_device_added() uses address which is freed at line 537 [2].

[1] ​http://cgit.haiku-os.org/haiku/tree/src/add-ons/kernel/drivers/common/usb_modeswitch.cpp#n538 [2] ​http://cgit.haiku-os.org/haiku/tree/src/add-ons/kernel/drivers/common/usb_modeswitch.cpp#n537

Attachments (2)

0039-usb_modeswitch.cpp-fix-use-after-free.patch​ (1.1 KB ) - added by mt 7 years ago.
report-edf6bb.html​ (113.9 KB ) - added by mt 7 years ago.
Report by Clang Static Analyzer

Download all attachments as: .zip

Change History (5)

by mt, 7 years ago

Attachment: 0039-usb_modeswitch.cpp-fix-use-after-free.patch​ added

comment:1 by mt, 7 years ago

patch: 0 → 1

by mt, 7 years ago

Attachment: report-edf6bb.html​ added

Report by Clang Static Analyzer

comment:2 by korli, 7 years ago

1/ drop the else 2/ "id" isn't a nice name, for instance notifySemId is better.

comment:3 by pulkomandy, 7 years ago

Resolution: → fixed
Status: new → closed

Applied in hrev50868, and Korli's suggested changes in hrev50869.

Note: See TracTickets for help on using tickets.