-
Notifications
You must be signed in to change notification settings - Fork 245
Closed
Labels
Description
It looks (not tested) like we may have null pointer reference in case that client failed to allocate codec:
-
if createBufferAndCodec failure, returns NULL:
erpc/erpc_c/infra/erpc_client_manager.cpp
Lines 190 to 211 in 9974b80
Codec *ClientManager::createBufferAndCodec(void) { Codec *codec = m_codecFactory->create(); MessageBuffer message; if (codec != NULL) { message = m_messageFactory->create(); if (NULL != message.get()) { codec->setBuffer(message); } else { // Dispose of buffers and codecs. m_codecFactory->dispose(codec); codec = NULL; } } return codec; } -
createRequest returns RequestContext with NULL codec:
erpc/erpc_c/infra/erpc_client_manager.cpp
Lines 32 to 38 in 9974b80
RequestContext ClientManager::createRequest(bool isOneway) { // Create codec to read and write the request. Codec *codec = createBufferAndCodec(); return RequestContext(++m_sequence, codec, isOneway); } -
In the auto generated code, err is set and releaseRequest is called:
// Get a new request.
RequestContext request = g_client->createRequest(false);
// Encode the request.
Codec * codec = request.getCodec();
if (codec == NULL)
{
err = kErpcStatus_MemoryError;
}
else
{
...
}
// Dispose of the request.
g_client->releaseRequest(request);
- The null codec dereferenced
erpc/erpc_c/infra/erpc_client_manager.cpp
Lines 213 to 215 in 9974b80
void ClientManager::releaseRequest(RequestContext &request) { m_messageFactory->dispose(request.getCodec()->getBuffer());