diff options
| author | Ihor Dutchak <ihor.youw@gmail.com> | 2022-08-19 22:34:29 +0300 |
|---|---|---|
| committer | Tormod Volden <debian.tormod@gmail.com> | 2022-09-03 11:46:21 +0200 |
| commit | 2ca64b364ba8835bd4b12ce6ec86f5aec72bb9e4 (patch) | |
| tree | c46c1960f1b64740e1625be79c50cdc7a955b6a2 | |
| parent | ff8fe9397d4c61f072d209703f854c9f62ed17e3 (diff) | |
| download | libusb-2ca64b364ba8835bd4b12ce6ec86f5aec72bb9e4.tar.gz | |
Fix possible memory leak of configuration descriptor (Darwin/Windows)
The config descriptor was not released in some (rare) cases:
- Darwin: never released in case GetPipeProperties failed
- Windows: not released for some non-USB compliant descriptors
Follow-up of commit f5275f9a and commit aa1d76cd
References #1093
References #1039
Closes #1183
Signed-off-by: Tormod Volden <debian.tormod@gmail.com>
| -rw-r--r-- | libusb/os/darwin_usb.c | 3 | ||||
| -rw-r--r-- | libusb/os/windows_winusb.c | 10 | ||||
| -rw-r--r-- | libusb/version_nano.h | 2 |
3 files changed, 10 insertions, 5 deletions
diff --git a/libusb/os/darwin_usb.c b/libusb/os/darwin_usb.c index c7cbc38..3f3a35a 100644 --- a/libusb/os/darwin_usb.c +++ b/libusb/os/darwin_usb.c @@ -1433,11 +1433,14 @@ static enum libusb_error get_endpoints (struct libusb_device_handle *dev_handle, if (iface >= config->bNumInterfaces) { usbi_err (HANDLE_CTX (dev_handle), "interface %d out of range for device", iface); + libusb_free_config_descriptor (config); return LIBUSB_ERROR_NOT_FOUND; } + endpoint_desc = config->interface[iface].altsetting[alt_setting].endpoint + i - 1; cInterface->endpoint_addrs[i - 1] = endpoint_desc->bEndpointAddress; + libusb_free_config_descriptor (config); } else { cInterface->endpoint_addrs[i - 1] = (UInt8)(((kUSBIn == direction) << kUSBRqDirnShift) | (number & LIBUSB_ENDPOINT_ADDRESS_MASK)); } diff --git a/libusb/os/windows_winusb.c b/libusb/os/windows_winusb.c index 10480b7..5850a7f 100644 --- a/libusb/os/windows_winusb.c +++ b/libusb/os/windows_winusb.c @@ -525,7 +525,8 @@ static int windows_assign_endpoints(struct libusb_device_handle *dev_handle, uin if (iface >= conf_desc->bNumInterfaces) { usbi_err(HANDLE_CTX(dev_handle), "interface %d out of range for device", iface); - return LIBUSB_ERROR_NOT_FOUND; + r = LIBUSB_ERROR_NOT_FOUND; + goto end; } if_desc = &conf_desc->interface[iface].altsetting[altsetting]; safe_free(priv->usb_interface[iface].endpoint); @@ -535,8 +536,8 @@ static int windows_assign_endpoints(struct libusb_device_handle *dev_handle, uin } else { priv->usb_interface[iface].endpoint = malloc(if_desc->bNumEndpoints); if (priv->usb_interface[iface].endpoint == NULL) { - libusb_free_config_descriptor(conf_desc); - return LIBUSB_ERROR_NO_MEM; + r = LIBUSB_ERROR_NO_MEM; + goto end; } priv->usb_interface[iface].nb_endpoints = if_desc->bNumEndpoints; for (i = 0; i < if_desc->bNumEndpoints; i++) { @@ -544,7 +545,6 @@ static int windows_assign_endpoints(struct libusb_device_handle *dev_handle, uin usbi_dbg(HANDLE_CTX(dev_handle), "(re)assigned endpoint %02X to interface %u", priv->usb_interface[iface].endpoint[i], iface); } } - libusb_free_config_descriptor(conf_desc); // Extra init may be required to configure endpoints if (priv->apib->configure_endpoints) @@ -553,6 +553,8 @@ static int windows_assign_endpoints(struct libusb_device_handle *dev_handle, uin if (r == LIBUSB_SUCCESS) priv->usb_interface[iface].current_altsetting = altsetting; +end: + libusb_free_config_descriptor(conf_desc); return r; } diff --git a/libusb/version_nano.h b/libusb/version_nano.h index 1c218ef..173c4f9 100644 --- a/libusb/version_nano.h +++ b/libusb/version_nano.h @@ -1 +1 @@ -#define LIBUSB_NANO 11742 +#define LIBUSB_NANO 11743 |