Skip to content

Fix potential double dealloc with tlv_from_apdu #782

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
apaillier-ledger merged 1 commit into from
Apr 30, 2025
Merged

Fix potential double dealloc with tlv_from_apdu #782

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions src/tlv_apdu.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,8 @@ static uint16_t g_tlv_size = 0;
static uint16_t g_tlv_pos = 0;
static bool g_dyn = false;

static void reset_state(void) {
if (g_tlv_payload != NULL) {
static void reset_state(bool free) {
if ((g_tlv_payload != NULL) && free) {
mem_dealloc(g_tlv_size);
}
g_tlv_payload = NULL;
Expand Down Expand Up @@ -46,7 +46,7 @@ bool tlv_from_apdu(bool first_chunk,
#ifdef HAVE_DYN_MEM_ALLOC
if (g_tlv_payload != NULL) {
PRINTF("Error: remnants from an incomplete TLV payload!\n");
reset_state();
reset_state(true);
return false;
}

Expand All @@ -64,15 +64,15 @@ bool tlv_from_apdu(bool first_chunk,
}
#ifdef HAVE_DYN_MEM_ALLOC
if (g_dyn && (g_tlv_payload == NULL)) {
reset_state();
reset_state(true);
return false;
}
#endif
chunk_length = lc - offset;
if ((g_tlv_pos + chunk_length) > g_tlv_size) {
PRINTF("TLV payload bigger than expected!\n");
#ifdef HAVE_DYN_MEM_ALLOC
reset_state();
reset_state(true);
#endif
return false;
}
Expand All @@ -88,7 +88,7 @@ bool tlv_from_apdu(bool first_chunk,
if (g_tlv_pos == g_tlv_size) {
#ifdef HAVE_DYN_MEM_ALLOC
ret = (*handler)(g_dyn ? g_tlv_payload : &payload[offset], g_tlv_size, g_dyn);
reset_state();
reset_state(false); // already deallocated in the handler
#else
ret = (*handler)(&payload[offset], g_tlv_size, false);
#endif
Expand Down
Loading