andy/flipper-bluepp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Fix use-after-free on exit in BLE GATT Server

Browse Source 
Teardown freed the view port before unhooking the serial and status
callbacks, which run on the BLE/BT thread and call view_port_update. A late
notification or status change during exit could touch freed memory. Unhook
both callbacks and restore the default profile first, then free the view port.
This commit is contained in:
andy
2026-09-11 14:33:18 +01:00
parent e3adcda565
commit 9e62ec5cfe
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ble_gattsrv/ble_gattsrv.c
+5 -3
View File
@@ -131,15 +131,17 @@ int32_t ble_gattsrv_app(void* p) {
}
}
gui_remove_view_port(app->gui, app->vp);
view_port_free(app->vp);
furi_record_close(RECORD_GUI);
// Unhook every callback that runs on the BLE/BT thread BEFORE freeing the
// view port, or serial_cb/status_cb can call view_port_update on freed memory.
if(app->profile) {
ble_profile_serial_set_event_callback(app->profile, 0, NULL, NULL);
bt_profile_restore_default(app->bt);
}
bt_set_status_changed_callback(app->bt, NULL, NULL);
furi_record_close(RECORD_BT);
gui_remove_view_port(app->gui, app->vp);
view_port_free(app->vp);
furi_record_close(RECORD_GUI);
furi_message_queue_free(app->input);
furi_mutex_free(app->mutex);
free(app);