RPCS3/hidapi
1
0
Fork 0
mirror of https://github.com/RPCS3/hidapi.git synced 2026-07-19 21:43:36 -04:00
Code Issues Packages Projects Releases Wiki Activity

libusb: Fix double free of buffer pointer in hid_close() (#395)

Browse Source 
Make buffer pointer NULL, once it is freed.

In hid_close() buffer pointer is freed and next to that the libusb_free_transfer function is called which checks for if the LIBUSB_TRANSFER_FREE_BUFFER flag is set and the buffer pointer is not NULL. when this condition evaluates true, it
tries to free memory for a buffer which is already free and a crash occurs.

Even though the described behavior should not happen as per libusb documentation, it has been observed with some version(s) of libusb.
This commit is contained in:
SNEHAL
2022-04-23 18:24:26 +05:30
committed by GitHub
parent bca404520f
commit 536bad201e
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libusb/hid.c
+1
View File
@@ -1408,6 +1408,7 @@ void HID_API_EXPORT hid_close(hid_device *dev)
/* Clean up the Transfer objects allocated in read_thread(). */
free(dev->transfer->buffer);
dev->transfer->buffer = NULL;
libusb_free_transfer(dev->transfer);
/* release the interface */