Skip to content

Commit 536bad2

Browse files
authored
libusb: Fix double free of buffer pointer in hid_close() (#395)
Make buffer pointer NULL, once it is freed. In hid_close() buffer pointer is freed and next to that the libusb_free_transfer function is called which checks for if the LIBUSB_TRANSFER_FREE_BUFFER flag is set and the buffer pointer is not NULL. when this condition evaluates true, it tries to free memory for a buffer which is already free and a crash occurs. Even though the described behavior should not happen as per libusb documentation, it has been observed with some version(s) of libusb.
1 parent bca4045 commit 536bad2

File tree

1 file changed

+1
-0
lines changed

1 file changed

+1
-0
lines changed

libusb/hid.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1408,6 +1408,7 @@ void HID_API_EXPORT hid_close(hid_device *dev)
14081408

14091409
/* Clean up the Transfer objects allocated in read_thread(). */
14101410
free(dev->transfer->buffer);
1411+
dev->transfer->buffer = NULL;
14111412
libusb_free_transfer(dev->transfer);
14121413

14131414
/* release the interface */

0 commit comments

Comments
 (0)