diff --git a/components/esp_local_ctrl/src/esp_local_ctrl.c b/components/esp_local_ctrl/src/esp_local_ctrl.c index 77f19ec118..3b286bc427 100644 --- a/components/esp_local_ctrl/src/esp_local_ctrl.c +++ b/components/esp_local_ctrl/src/esp_local_ctrl.c @@ -330,6 +330,10 @@ esp_err_t esp_local_ctrl_remove_property(const char *name) } local_ctrl_inst_ctx->props[i-1] = local_ctrl_inst_ctx->props[i]; } + /* Clear the stale pointer left in the last slot after compaction to + * prevent a double-free if esp_local_ctrl_stop() is called before the + * slot is overwritten by a subsequent add_property(). */ + local_ctrl_inst_ctx->props[local_ctrl_inst_ctx->props_count - 1] = NULL; local_ctrl_inst_ctx->props_count--; return ESP_OK; } diff --git a/components/esp_local_ctrl/src/esp_local_ctrl_transport_ble.c b/components/esp_local_ctrl/src/esp_local_ctrl_transport_ble.c index 248b410899..3f77f6caa5 100644 --- a/components/esp_local_ctrl/src/esp_local_ctrl_transport_ble.c +++ b/components/esp_local_ctrl/src/esp_local_ctrl_transport_ble.c @@ -1,16 +1,8 @@ -// Copyright 2019 Espressif Systems (Shanghai) PTE LTD -// -// Licensed under the Apache License, Version 2.0 (the "License"); -// you may not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, software -// distributed under the License is distributed on an "AS IS" BASIS, -// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -// See the License for the specific language governing permissions and -// limitations under the License. +/* + * SPDX-FileCopyrightText: 2019-2026 Espressif Systems (Shanghai) CO LTD + * + * SPDX-License-Identifier: Apache-2.0 + */ #include #include @@ -73,21 +65,33 @@ static esp_err_t copy_ble_config(esp_local_ctrl_transport_config_t *dest_config, free(dest_config->ble); return ESP_ERR_NO_MEM; } + esp_err_t ret = ESP_OK; for (uint16_t i = 0; i < src_config->ble->nu_lookup_count; i++) { dest_config->ble->nu_lookup[i].uuid = src_config->ble->nu_lookup[i].uuid; if (!src_config->ble->nu_lookup[i].name) { ESP_LOGE(TAG, "Endpoint name cannot be null"); - return ESP_ERR_INVALID_ARG; + ret = ESP_ERR_INVALID_ARG; + goto err_free_nu_lookup; } dest_config->ble->nu_lookup[i].name = strdup(src_config->ble->nu_lookup[i].name); if (!dest_config->ble->nu_lookup[i].name) { ESP_LOGE(TAG, "Failed to allocate memory for endpoint name"); - return ESP_ERR_NO_MEM; + ret = ESP_ERR_NO_MEM; + goto err_free_nu_lookup; } dest_config->ble->nu_lookup_count++; } } return ESP_OK; + +err_free_nu_lookup: + for (uint16_t i = 0; i < dest_config->ble->nu_lookup_count; i++) { + free((void *) dest_config->ble->nu_lookup[i].name); + } + free(dest_config->ble->nu_lookup); + free(dest_config->ble); + dest_config->ble = NULL; + return ret; } static esp_err_t declare_endpoint(esp_local_ctrl_transport_config_t *config, const char *ep_name, uint16_t ep_uuid) diff --git a/tools/ci/check_copyright_ignore.txt b/tools/ci/check_copyright_ignore.txt index 0a7316fe69..bbcf995f91 100644 --- a/tools/ci/check_copyright_ignore.txt +++ b/tools/ci/check_copyright_ignore.txt @@ -378,7 +378,6 @@ components/esp_hid/include/esp_hidh_gattc.h components/esp_hid/private/bt_hidd.h components/esp_hid/private/bt_hidh.h components/esp_local_ctrl/src/esp_local_ctrl_priv.h -components/esp_local_ctrl/src/esp_local_ctrl_transport_ble.c components/esp_rom/esp32/include/esp32/rom/tjpgd.h components/esp_rom/esp32/ld/esp32.rom.api.ld components/esp_rom/esp32/ld/esp32.rom.eco3.ld