(nuttx) branch master updated: net/local: fix SCM_RIGHTS pointer and memory corruption

[xiaoxiang]

This is an automated email from the ASF dual-hosted git repository.

xiaoxiang781216 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git


The following commit(s) were added to refs/heads/master by this push:
     new 8142b7f79bd net/local: fix SCM_RIGHTS pointer and memory corruption
8142b7f79bd is described below

commit 8142b7f79bdbea9470649f718212d70be57def5a
Author: Bogdan <bogdan4ik0...@gmail.com>
AuthorDate: Wed Aug 19 21:39:39 2026 +0300

    net/local: fix SCM_RIGHTS pointer and memory corruption
    
    Fix NULL pointer dereference and memory corruption by using
    file_put() instead of file_close() + kmm_free().
    Add peer NULL check to local_freectl().
    
    Signed-off-by: Bogdan <bogdan4ik0...@gmail.com>
---
 net/local/local_conn.c    | 3 +--
 net/local/local_recvmsg.c | 2 +-
 net/local/local_sendmsg.c | 5 +++++
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/net/local/local_conn.c b/net/local/local_conn.c
index daaddfc62f8..df9674f31f7 100644
--- a/net/local/local_conn.c
+++ b/net/local/local_conn.c
@@ -338,8 +338,7 @@ void local_free(FAR struct local_conn_s *conn)
     {
       if (conn->lc_cfps[i])
         {
-          file_close(conn->lc_cfps[i]);
-          kmm_free(conn->lc_cfps[i]);
+          file_put(conn->lc_cfps[i]);
           conn->lc_cfps[i] = NULL;
         }
     }
diff --git a/net/local/local_recvmsg.c b/net/local/local_recvmsg.c
index 2197e4bb756..ce8abadd86c 100644
--- a/net/local/local_recvmsg.c
+++ b/net/local/local_recvmsg.c
@@ -191,7 +191,7 @@ static void local_recvctl(FAR struct local_conn_s *conn,
     {
       if (peer->lc_cfpcount)
         {
-          memmove(peer->lc_cfps[0], peer->lc_cfps[i],
+          memmove(&peer->lc_cfps[0], &peer->lc_cfps[i],
                   sizeof(FAR void *) * peer->lc_cfpcount);
         }
     }
diff --git a/net/local/local_sendmsg.c b/net/local/local_sendmsg.c
index 0bf31e7a823..33c488377f3 100644
--- a/net/local/local_sendmsg.c
+++ b/net/local/local_sendmsg.c
@@ -63,6 +63,11 @@ static void local_freectl(FAR struct local_conn_s *conn, int 
count)
 {
   FAR struct local_conn_s *peer = conn->lc_peer;
 
+  if (peer == NULL)
+    {
+      peer = conn;
+    }
+
   while (count-- > 0)
     {
       file_put(peer->lc_cfps[--peer->lc_cfpcount]);