libftdi Archives

Subject: Re: [1.0] 2 invalid frees and multiple invalid reads and writes in ftdi_usb_get_strings

From: Uwe Bonnes <bon@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx>
To: libftdi@xxxxxxxxxxxxxxxxxxxxxxx
Date: Tue, 28 Jun 2011 15:14:35 +0200
>>>>> "Matthias" == Matthias Janke <matthias.janke@xxxxxxxxxxxxxxxxxxxxxxx> 
>>>>> writes:

    Matthias> Am Mon, 27 Jun 2011 15:33:29 +0200 schrieb Matthias Janke
    Matthias> <matthias.janke@xxxxxxxxxxxxxxxxxxxxxxx>:

    >> As far as I could locate it they all come from ftdi_usb_get_strings
    >> downwards.

    Matthias> That was actually wrong. The root of the problem is that in
    Matthias> ftdi_usb_find_all at line 307 devs is completely freed, while
    Matthias> devlist has still references to elements in dev. So using
    Matthias> devlist in any way causes invalid reads, writes and frees. A
    Matthias> solution would be to add an else to the if in line 294 which
    Matthias> frees just the non ftdi elements of devs. but would that be a
    Matthias> clean solution? why is devlist aliased to currdev?

What about the solution in the just sent patch to keep the devlist in
ftdi_context and only free it on exit.
-- 
Uwe Bonnes                bon@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Institut fuer Kernphysik  Schlossgartenstrasse 9  64289 Darmstadt
--------- Tel. 06151 162516 -------- Fax. 06151 164321 ----------

--
libftdi - see http://www.intra2net.com/en/developer/libftdi for details.
To unsubscribe send a mail to libftdi+unsubscribe@xxxxxxxxxxxxxxxxxxxxxxx   

Current Thread