From 536bad201e75fb398c2447dbae5e6a70b0ac7137 Mon Sep 17 00:00:00 2001
From: SNEHAL <101412040+Sneha1P@users.noreply.github.com>
Date: Sat, 23 Apr 2022 18:24:26 +0530
Subject: [PATCH] libusb: Fix double free of buffer pointer in hid_close()
 (#395)

Make buffer pointer NULL, once it is freed.

In hid_close() buffer pointer is freed and next to that the libusb_free_transfer function is called which checks for if the LIBUSB_TRANSFER_FREE_BUFFER flag is set and the buffer pointer is not NULL. when this condition evaluates true, it
tries to free memory for a buffer which is already free and a crash occurs.

Even though the described behavior should not happen as per libusb documentation, it has been observed with some version(s) of libusb.
---
 libusb/hid.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/libusb/hid.c b/libusb/hid.c
index cd92138..66ed378 100644
--- a/libusb/hid.c
+++ b/libusb/hid.c
@@ -1408,6 +1408,7 @@ void HID_API_EXPORT hid_close(hid_device *dev)
 
 	/* Clean up the Transfer objects allocated in read_thread(). */
 	free(dev->transfer->buffer);
+	dev->transfer->buffer = NULL;
 	libusb_free_transfer(dev->transfer);
 
 	/* release the interface */