andy/flipper-bluepp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Fix use-after-free on exit in BLE GATT Server

Browse Source 
Teardown freed the view port before unhooking the serial and status
callbacks, which run on the BLE/BT thread and call view_port_update. A late
notification or status change during exit could touch freed memory. Unhook
both callbacks and restore the default profile first, then free the view port.
This commit is contained in:
andy
2026-09-07 01:49:30 +01:00
parent 421b9f0585
commit 4c309faf1e
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ble_gattsrv/ble_gattsrv.c
+5 -3
View File
@@ -131,15 +131,17 @@ int32_t ble_gattsrv_app(void* p) {
} }
} }
gui_remove_view_port(app->gui, app->vp); // Unhook every callback that runs on the BLE/BT thread BEFORE freeing the
view_port_free(app->vp); // view port, or serial_cb/status_cb can call view_port_update on freed memory.
furi_record_close(RECORD_GUI);
if(app->profile) { if(app->profile) {
ble_profile_serial_set_event_callback(app->profile, 0, NULL, NULL); ble_profile_serial_set_event_callback(app->profile, 0, NULL, NULL);
bt_profile_restore_default(app->bt); bt_profile_restore_default(app->bt);
} }
bt_set_status_changed_callback(app->bt, NULL, NULL); bt_set_status_changed_callback(app->bt, NULL, NULL);
furi_record_close(RECORD_BT); furi_record_close(RECORD_BT);
gui_remove_view_port(app->gui, app->vp);
view_port_free(app->vp);
furi_record_close(RECORD_GUI);
furi_message_queue_free(app->input); furi_message_queue_free(app->input);
furi_mutex_free(app->mutex); furi_mutex_free(app->mutex);
free(app); free(app);