mirror of
https://github.com/espressif/esp-idf.git
synced 2026-07-23 03:13:01 +03:00
handle_session_command0() freed cur_session->srp_hd on every error path without clearing the pointer. A subsequent sec2_close_session() call (e.g. on BLE disconnect, or via sec2_new_session evicting the old session) checks `if (cur_session->srp_hd)` and frees it again, double-freeing a dangling pointer.