[incubator-nuttx-apps] branch master updated: nshlib: Fix memory corruption in nsh_parse.c

[jerpelea]

This is an automated email from the ASF dual-hosted git repository.

jerpelea pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/incubator-nuttx-apps.git


The following commit(s) were added to refs/heads/master by this push:
     new 7f48576  nshlib: Fix memory corruption in nsh_parse.c
7f48576 is described below

commit 7f4857621851a686c2d7def50cd7f6c8d0f15b98
Author: Masayuki Ishikawa <masayuki.ishik...@gmail.com>
AuthorDate: Tue Aug 11 16:15:16 2020 +0900

    nshlib: Fix memory corruption in nsh_parse.c
    
    Summary:
    - Fix memory corruption when pthread_create() failed in nsh_execute()
    
    Impact:
    
    - nsh builtin command execution in background with errors
    
    Testing:
    
    - Tested with hifive1-revb:nsh
    - Set CONFIG_MAX_TASKS=4
    - Run 'sleep 1000 &' in 3 times will cause pthread_create error
    - Run free, ps command
    
    Reported-by: Yoshinori Sugino <ysgn0...@gmail.com>
    Signed-off-by: Masayuki Ishikawa <masayuki.ishik...@jp.sony.com>
---
 nshlib/nsh_parse.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/nshlib/nsh_parse.c b/nshlib/nsh_parse.c
index 9b0bb2f..b035455 100644
--- a/nshlib/nsh_parse.c
+++ b/nshlib/nsh_parse.c
@@ -654,8 +654,10 @@ static int nsh_execute(FAR struct nsh_vtbl_s *vtbl,
         {
           nsh_error(vtbl, g_fmtcmdfailed, argv[0], "sched_getparm",
                     NSH_ERRNO);
+
+          /* NOTE: bkgvtbl is released in nsh_relaseargs() */
+
           nsh_releaseargs(args);
-          nsh_release(bkgvtbl);
           goto errout;
         }
 
@@ -699,8 +701,10 @@ static int nsh_execute(FAR struct nsh_vtbl_s *vtbl,
         {
           nsh_error(vtbl, g_fmtcmdfailed, argv[0], "pthread_create",
                     NSH_ERRNO_OF(ret));
+
+          /* NOTE: bkgvtbl is released in nsh_relaseargs() */
+
           nsh_releaseargs(args);
-          nsh_release(bkgvtbl);
           goto errout;
         }