esp_event: fix crash when unregistering a handler instance in itself (IDFGH-1940) #4139
Conversation
When a handler instance is the last one in the list und unregisters itself, the handler iterator will be invalidated by entering free'd memory. Same applies for event base and id, if they become empty.
|
|
github-actions
bot
changed the title
| esp_event_base_node_t *base_node; | ||
| esp_event_id_node_t *id_node; | ||
| esp_event_base_node_t *base_node, *temp_base; | ||
| esp_event_id_node_t *id_node, *temp_id_node; | ||
|
|
||
| SLIST_FOREACH(loop_node, &(loop->loop_nodes), next) { |
There was a problem hiding this comment.
This seems to also need the safe foreach variant.
There was a problem hiding this comment.
Sorry for the long silence, but you're right. I've also seen your fixup.
When a handler instance is the last one in the list und unregisters itself, the handler iterator will be invalidated by entering free'd memory. Same applies for event base and id, if they become empty. Merges espressif#4139
|
After further debugging, I've detected a heap corruption when using event profiling. When unregistering event handlers in themselves, the esp-idf/components/esp_event/esp_event.c Lines 132 to 140 in 0a0f2ca A possible solution is to move |
|
Hi @xentec, can you open a new issue to track this? I only noticed your reply now. Assign the issue to me if Github allows it (I'm not sure). |
When a handler instance is the last one in the list und unregisters itself, the handler iterator will be invalidated by entering free'd memory. Same applies for event base and id, if they become empty. Merges #4139
When a handler instance is the last one in the list und unregisters itself, the handler iterator will be invalidated by entering free'd memory. Same applies for event base and id, if they become empty. Merges #4139
When a handler instance is the last one in the list und unregisters itself, the handler iterator will be invalidated by entering free'd memory. Same applies for event base and id, if they become empty.