espressif/esp-idf
1
0
Fork 1
mirror of https://github.com/espressif/esp-idf.git synced 2025-07-30 18:57:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'bugfix/eloop_timer_crash_v5.0' into 'release/v5.0'

Browse Source 
wpa_supplicant: Validate eloop struct before deleting it (v5.0)

See merge request espressif/esp-idf!20846
This commit is contained in:
Jiang Jiang Jian
2022-10-28 16:29:34 +08:00
parent a43a6809c7 2444d99612
commit 237a5a0585
1 changed files with 18 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
components/wpa_supplicant/port/eloop.c
View File

@ -140,16 +140,31 @@ overflow:
return 0; return 0;
} }
static bool timeout_exists(struct eloop_timeout *old)
{
struct eloop_timeout *timeout, *prev;
dl_list_for_each_safe(timeout, prev, &eloop.timeout,
struct eloop_timeout, list) {
if (old == timeout)
return true;
}
return false;
}
static void eloop_remove_timeout(struct eloop_timeout *timeout) static void eloop_remove_timeout(struct eloop_timeout *timeout)
{ {
bool timeout_present = false;
ELOOP_LOCK(); ELOOP_LOCK();
dl_list_del(&timeout->list); /* Make sure timeout still exists(Another context may have deleted this) */
timeout_present = timeout_exists(timeout);
if (timeout_present)
dl_list_del(&timeout->list);
ELOOP_UNLOCK(); ELOOP_UNLOCK();
os_free(timeout); if (timeout_present)
os_free(timeout);
} }
#ifdef ELOOP_DEBUG #ifdef ELOOP_DEBUG
int eloop_cancel_timeout_debug(eloop_timeout_handler handler, void *eloop_data, int eloop_cancel_timeout_debug(eloop_timeout_handler handler, void *eloop_data,
void *user_data, const char *func, int line) void *user_data, const char *func, int line)