uledd: led_timer_cb tries to access freed structure struct blob_led *b
Open
Nobody has claimed this yet.
stale
- Dominant language
- Makefile
- Stars
- 4.6k
- Forks
- 4k
- Avg merge
- 3d 12h
- Merged PRs (30d)
- 134
Description
Maintainer: @blogic
Description:
I tried to blink led (green:led1 in my case) using ubus call:
ubus call led set '{ "leds": { "green:led1":1, "red:led2":0, "blue:led3":0}, "on": 2000, "off": 2000, "blink": 1 }'
This triggers calls to led_timer_cb, where values of led->b->original and led->b->brightness
have undefined values (like: -1229065472).
I found out that ubus.c -> led_parse_handler free this memory, before led_timer_cb is called.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in ubus.c at led_parse_handler and led_timer_cb, then reproduce the issue with the ubus call shown in the report. Trace the lifetime of struct blob_led between parsing and the timer callback. Done means the callback no longer reads freed structure data and the reported blinking behavior works without undefined values.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- embedded-iot
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 42/100