depau/libfprint
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

upeksonly: fix double free in usb transfer cbs

Browse source 
Some USB transfer callbacks in this driver were freeing their transfer
buffer in their callbacks, which causes a double free since the transfer
itself frees them afterwards. Probably just got missed during the V2 api
changes.
This commit is contained in:
Matthew Mirvish 2021-04-11 07:25:48 -04:00
parent 7fcce7891a
commit 07778f6bfa
1 changed files with 0 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
libfprint/drivers/upeksonly.c
View file

@ -693,8 +693,6 @@ sm_read_reg_cb (FpiUsbTransfer *transfer, FpDevice *device,
fp_dbg ("read reg result = %02x", self->read_reg_result); fp_dbg ("read reg result = %02x", self->read_reg_result);
fpi_ssm_next_state (transfer->ssm); fpi_ssm_next_state (transfer->ssm);
} }
g_free (transfer->buffer);
} }
static void static void
@ -731,7 +729,6 @@ sm_await_intr_cb (FpiUsbTransfer *transfer, FpDevice *device,
if (error) if (error)
{ {
g_free (transfer->buffer);
fpi_ssm_mark_failed (transfer->ssm, error); fpi_ssm_mark_failed (transfer->ssm, error);
return; return;
} }
@ -739,7 +736,6 @@ sm_await_intr_cb (FpiUsbTransfer *transfer, FpDevice *device,
fp_dbg ("interrupt received: %02x %02x %02x %02x", fp_dbg ("interrupt received: %02x %02x %02x %02x",
transfer->buffer[0], transfer->buffer[1], transfer->buffer[0], transfer->buffer[1],
transfer->buffer[2], transfer->buffer[3]); transfer->buffer[2], transfer->buffer[3]);
g_free (transfer->buffer);
self->finger_state = FINGER_DETECTED; self->finger_state = FINGER_DETECTED;
fpi_image_device_report_finger_status (dev, TRUE); fpi_image_device_report_finger_status (dev, TRUE);