Skip to content

Commit

Permalink
Fix for TLSF allocator crashes
Browse files Browse the repository at this point in the history
ASN_STRUCT_FREE() seems to be used to free nested structs
Here, structs are allocated in different functions and freed
individually
No need to use ASN_STRUCT_FREE(), it leads to double free()
  • Loading branch information
Willy-JL committed May 22, 2024
1 parent 3289a78 commit a582863
Showing 1 changed file with 20 additions and 20 deletions.
40 changes: 20 additions & 20 deletions sam_api.c
Original file line number Diff line number Diff line change
Expand Up @@ -231,7 +231,7 @@ void seader_send_response(

seader_send_payload(seader_uart, payload, to, from, replyTo);

ASN_STRUCT_FREE(asn_DEF_Payload, payload);
free(payload);
}

void seader_send_request_pacs(Seader* seader) {
Expand Down Expand Up @@ -262,9 +262,9 @@ void seader_send_request_pacs(Seader* seader) {

seader_send_payload(seader_uart, payload, 0x44, 0x0a, 0x44);

ASN_STRUCT_FREE(asn_DEF_RequestPacs, requestPacs);
ASN_STRUCT_FREE(asn_DEF_SamCommand, samCommand);
ASN_STRUCT_FREE(asn_DEF_Payload, payload);
free(requestPacs);
free(samCommand);
free(payload);
}

void seader_worker_send_serial_number(Seader* seader) {
Expand All @@ -287,8 +287,8 @@ void seader_worker_send_serial_number(Seader* seader) {

seader_send_payload(seader_uart, payload, 0x44, 0x0a, 0x44);

ASN_STRUCT_FREE(asn_DEF_SamCommand, samCommand);
ASN_STRUCT_FREE(asn_DEF_Payload, payload);
free(samCommand);
free(payload);
}

void seader_worker_send_version(Seader* seader) {
Expand All @@ -311,8 +311,8 @@ void seader_worker_send_version(Seader* seader) {

seader_send_payload(seader_uart, payload, 0x44, 0x0a, 0x44);

ASN_STRUCT_FREE(asn_DEF_SamCommand, samCommand);
ASN_STRUCT_FREE(asn_DEF_Payload, payload);
free(samCommand);
free(payload);
}

void seader_send_card_detected(Seader* seader, CardDetails_t* cardDetails) {
Expand Down Expand Up @@ -341,9 +341,9 @@ void seader_send_card_detected(Seader* seader, CardDetails_t* cardDetails) {

seader_send_payload(seader_uart, payload, 0x44, 0x0a, 0x44);

ASN_STRUCT_FREE(asn_DEF_Payload, payload);
ASN_STRUCT_FREE(asn_DEF_SamCommand, samCommand);
ASN_STRUCT_FREE(asn_DEF_CardDetected, cardDetected);
free(payload);
free(samCommand);
free(cardDetected);
}

bool seader_unpack_pacs(Seader* seader, uint8_t* buf, size_t size) {
Expand Down Expand Up @@ -394,7 +394,7 @@ bool seader_unpack_pacs(Seader* seader, uint8_t* buf, size_t size) {
}
}

ASN_STRUCT_FREE(asn_DEF_PAC, pac);
free(pac);
return rtn;
}

Expand Down Expand Up @@ -434,7 +434,7 @@ bool seader_parse_version(SeaderWorker* seader_worker, uint8_t* buf, size_t size
rtn = true;
}

ASN_STRUCT_FREE(asn_DEF_SamVersion, version);
free(version);
return rtn;
}

Expand Down Expand Up @@ -597,9 +597,9 @@ void seader_send_nfc_rx(SeaderUartBridge* seader_uart, uint8_t* buffer, size_t l

seader_send_response(seader_uart, response, 0x14, 0x0a, 0x0);

ASN_STRUCT_FREE(asn_DEF_NFCRx, nfcRx);
ASN_STRUCT_FREE(asn_DEF_NFCResponse, nfcResponse);
ASN_STRUCT_FREE(asn_DEF_Response, response);
free(nfcRx);
free(nfcResponse);
free(response);
}

void seader_capture_sio(BitBuffer* tx_buffer, BitBuffer* rx_buffer, SeaderCredential* credential) {
Expand Down Expand Up @@ -953,8 +953,8 @@ void seader_parse_nfc_off(SeaderUartBridge* seader_uart) {

seader_send_response(seader_uart, response, 0x44, 0x0a, 0);

ASN_STRUCT_FREE(asn_DEF_Response, response);
ASN_STRUCT_FREE(asn_DEF_NFCResponse, nfcResponse);
free(response);
free(nfcResponse);
}

void seader_parse_nfc_command(Seader* seader, NFCCommand_t* nfcCommand, SeaderPollerContainer* spc) {
Expand Down Expand Up @@ -1047,7 +1047,7 @@ bool seader_process_success_response_i(
FURI_LOG_D(TAG, "Failed to decode APDU payload: [%s]", display);
}

ASN_STRUCT_FREE(asn_DEF_Payload, payload);
free(payload);
return processed;
}

Expand Down Expand Up @@ -1104,6 +1104,6 @@ NfcCommand seader_worker_card_detect(

seader_send_card_detected(seader, cardDetails);

ASN_STRUCT_FREE(asn_DEF_CardDetails, cardDetails);
free(cardDetails);
return NfcCommandContinue;
}

0 comments on commit a582863

Please sign in to comment.