From 7f4857621851a686c2d7def50cd7f6c8d0f15b98 Mon Sep 17 00:00:00 2001 From: Masayuki Ishikawa Date: Tue, 11 Aug 2020 16:15:16 +0900 Subject: [PATCH] nshlib: Fix memory corruption in nsh_parse.c Summary: - Fix memory corruption when pthread_create() failed in nsh_execute() Impact: - nsh builtin command execution in background with errors Testing: - Tested with hifive1-revb:nsh - Set CONFIG_MAX_TASKS=4 - Run 'sleep 1000 &' in 3 times will cause pthread_create error - Run free, ps command Reported-by: Yoshinori Sugino Signed-off-by: Masayuki Ishikawa --- nshlib/nsh_parse.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/nshlib/nsh_parse.c b/nshlib/nsh_parse.c index 9b0bb2f71..b0354553a 100644 --- a/nshlib/nsh_parse.c +++ b/nshlib/nsh_parse.c @@ -654,8 +654,10 @@ static int nsh_execute(FAR struct nsh_vtbl_s *vtbl, { nsh_error(vtbl, g_fmtcmdfailed, argv[0], "sched_getparm", NSH_ERRNO); + + /* NOTE: bkgvtbl is released in nsh_relaseargs() */ + nsh_releaseargs(args); - nsh_release(bkgvtbl); goto errout; } @@ -699,8 +701,10 @@ static int nsh_execute(FAR struct nsh_vtbl_s *vtbl, { nsh_error(vtbl, g_fmtcmdfailed, argv[0], "pthread_create", NSH_ERRNO_OF(ret)); + + /* NOTE: bkgvtbl is released in nsh_relaseargs() */ + nsh_releaseargs(args); - nsh_release(bkgvtbl); goto errout; }