https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=279556

--- Comment #1 from Ed Maste <[email protected]> ---
Encountered this issue again while trying to use Glasgow Interface Explorer
(https://glasgow-embedded.org/latest/intro.html) on FreeBSD. It segfaults when
it passes a bogus value to libusb_hotplug_deregister_callback:

(lldb) run
Process 31450 launched: '/home/emaste/.local/pipx/venvs/glasgow/bin/python'
(x86_64)
Process 31450 stopped
* thread #1, name = 'python3.11', stop reason = signal SIGSEGV: address not
mapped to object (fault address: 0x135ca80)
    frame #0: 0x000000083d178d66
libusb.so.3`libusb_hotplug_deregister_callback(ctx=0x00001ba50253be00,
handle=0x000000000135ca80) at libusb10_hotplug.c:411:2
   408                  return;
   409 
   410          HOTPLUG_LOCK(ctx);
-> 411          TAILQ_REMOVE(&ctx->hotplug_cbh, handle, entry);
   412          libusb_interrupt_event_handler(ctx);
   413          HOTPLUG_UNLOCK(ctx);
   414 
(lldb) bt
* thread #1, name = 'python3.11', stop reason = signal SIGSEGV: address not
mapped to object (fault address: 0x135ca80)
  * frame #0: 0x000000083d178d66
libusb.so.3`libusb_hotplug_deregister_callback(ctx=0x00001ba50253be00,
handle=0x000000000135ca80) at libusb10_hotplug.c:411:2

python-libusb1:

https://github.com/vpelletier/python-libusb1/blob/292143c8f4465fdcb2c35ed40cdd7e4dd8d031e1/usb1/__init__.py#L2800

        handle = c_int()
        callback_p = libusb1.libusb_hotplug_callback_fn_p(wrapped_callback)
        mayRaiseUSBError(libusb1.libusb_hotplug_register_callback(
            self.__context_p, events, flags, vendor_id, product_id, dev_class,
            callback_p, None, byref(handle),
        ))

so FreeBSD's libusb_hotplug_register_callback writes a `struct
libusb_hotplug_callback_handle_struct *` to handle

-- 
You are receiving this mail because:
You are the assignee for the bug.

Reply via email to