From c497e29ca1f88963c525351e60af23ed896a2b8c Mon Sep 17 00:00:00 2001 From: Iker Pedrosa Date: Mon, 29 Jul 2024 12:57:16 +0200 Subject: [PATCH] bindings: python: fix a use-after-free bug `req_cfg` variable is freed and then used, which would generate an error. Avoid this problem by freeing when the variable will no longer be used. Signed-off-by: Iker Pedrosa Reviewed-by: Kent Gibson Link: https://lore.kernel.org/r/3d8b12dd60eec59d4184c0bcc7d575b4eccbc22c.1722250385.git.ikerpedrosam@gmail.com Signed-off-by: Bartosz Golaszewski --- bindings/python/gpiod/ext/chip.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/bindings/python/gpiod/ext/chip.c b/bindings/python/gpiod/ext/chip.c index 28cf504..e8eaad8 100644 --- a/bindings/python/gpiod/ext/chip.c +++ b/bindings/python/gpiod/ext/chip.c @@ -274,14 +274,16 @@ static PyObject *chip_request_lines(chip_object *self, PyObject *args) Py_BEGIN_ALLOW_THREADS; request = gpiod_chip_request_lines(self->chip, req_cfg, line_cfg); Py_END_ALLOW_THREADS; - gpiod_request_config_free(req_cfg); - if (!request) + if (!request) { + gpiod_request_config_free(req_cfg); return Py_gpiod_SetErrFromErrno(); + } req_obj = Py_gpiod_MakeRequestObject(request, gpiod_request_config_get_event_buffer_size(req_cfg)); if (!req_obj) gpiod_line_request_release(request); + gpiod_request_config_free(req_cfg); return req_obj; } -- 2.30.2