Mahavir Jain dc41452462 fix(protocomm): null srp_hd after free in sec2 command0 error paths ...

handle_session_command0() freed cur_session->srp_hd on every error path
without clearing the pointer. A subsequent sec2_close_session() call
(e.g. on BLE disconnect, or via sec2_new_session evicting the old
session) checks `if (cur_session->srp_hd)` and frees it again,
double-freeing a dangling pointer.

2026-04-27 10:09:17 +05:30

..

security0.c

protocomm: Added SRP6a implementation as the security version 2.

2022-06-17 13:16:20 +00:00

security1.c

fix(protocomm): fixes potential issues that can lead to crash during device provisioning

2026-04-07 11:09:37 +08:00

security2.c

fix(protocomm): null srp_hd after free in sec2 command0 error paths

2026-04-27 10:09:17 +05:30