Skip to content

Commit 25b3d5f

Browse files
committed
fix(mdns): Fix use after free reported by coverity
Fixes CID 467739: Use after free in mdns.c, mdns_service_remove_for_host We should look only for one match in the service list, since if we assume there could be aliases, we might free one and reference the other.
1 parent 11846c7 commit 25b3d5f

File tree

1 file changed

+5
-13
lines changed

1 file changed

+5
-13
lines changed

components/mdns/mdns.c

Lines changed: 5 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -6398,22 +6398,14 @@ esp_err_t mdns_service_remove_for_host(const char *instance, const char *service
63986398
if (_mdns_service_match(a->service, service, proto, hostname)) {
63996399
if (_mdns_server->services != a) {
64006400
b->next = a->next;
6401-
_mdns_send_bye(&a, 1, false);
6402-
_mdns_remove_scheduled_service_packets(a->service);
6403-
_mdns_free_service(a->service);
6404-
free(a);
6405-
a = b->next;
6406-
continue;
64076401
} else {
64086402
_mdns_server->services = a->next;
6409-
_mdns_send_bye(&a, 1, false);
6410-
_mdns_remove_scheduled_service_packets(a->service);
6411-
_mdns_free_service(a->service);
6412-
free(a);
6413-
a = _mdns_server->services;
6414-
b = a;
6415-
continue;
64166403
}
6404+
_mdns_send_bye(&a, 1, false);
6405+
_mdns_remove_scheduled_service_packets(a->service);
6406+
_mdns_free_service(a->service);
6407+
free(a);
6408+
break;
64176409
}
64186410
b = a;
64196411
a = a->next;

0 commit comments

Comments
 (0)