Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Tedd Ho-Jeong An <hj.tedd.an@gmail.com>
To:     linux-bluetooth@vger.kernel.org
Subject: [BlueZ PATCH] gobex: Fix read from pointer after free
Date:   Fri, 18 Feb 2022 11:46:17 -0800
Message-Id: <20220218194617.160812-1-hj.tedd.an@gmail.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

From: Tedd Ho-Jeong An <tedd.an@intel.com>

This patch sets the pointer to null after free since the g_free(p)
doesn't set the pointer to NULL.

This is reported by the Coverity.

Fixes: 7e7d826aa1db ("gobex: Print error if data cannot be written")
---
 gobex/gobex.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/gobex/gobex.c b/gobex/gobex.c
index 185eed4d7..e9b89cead 100644
--- a/gobex/gobex.c
+++ b/gobex/gobex.c
@@ -471,6 +471,8 @@ encode:
 				check_srm_final(obex,
 						obex->tx_buf[0] & ~FINAL_BIT);
 			pending_pkt_free(p);
+			/* g_free() doesn't set the pointer to NULL */
+			p = NULL;
 		}
 
 		obex->tx_data = len;
-- 
2.25.1