Files
esp-idf/components/protocomm
Mahavir Jain 99b6d1dfc2 fix(protocomm): null srp_hd after free in sec2 command0 error paths
handle_session_command0() freed cur_session->srp_hd on every error path
without clearing the pointer. A subsequent sec2_close_session() call
(e.g. on BLE disconnect, or via sec2_new_session evicting the old
session) checks `if (cur_session->srp_hd)` and frees it again,
double-freeing a dangling pointer.
2026-04-27 10:09:43 +05:30
..
2025-04-30 18:35:39 +08:00