mirror of
https://github.com/espressif/esp-idf.git
synced 2026-09-27 16:56:43 +03:00
Konstantin Kondrashov
e994067be0
esp_event_is_handler_registered() walked loop_nodes, base_nodes, id_nodes and handler lists with no lock held, then released an unowned mutex at the 'out:' label via xSemaphoreGive(). Concurrent register/unregister/delete operations can free handler nodes during the unlocked walk (SLIST UAF). The xSemaphoreGive on an unowned recursive mutex corrupts the recursive call-count of any task that legitimately holds the mutex. Fix: - Take loop->mutex with xSemaphoreTakeRecursive before the traversal. - Replace xSemaphoreGive at the 'out:' label with xSemaphoreGiveRecursive so every exit path holds the mutex for exactly one balanced take/give. Closes SEC_219