Fix UAF bug in read_ihex_chunks() when first chunk is reallocated #569
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Commit e473c83 partially fixed UAF errors by introducing backlink_p to update the previous chunk's next pointer after realloc. However, when the first chunk is reallocated, backlink_p is NULL, so the root pointer (*chunks_p) never gets updated, leaving it pointing to freed memory.
This causes a use-after-free/double-free when read_ihex_file() later tries to free the chunk list.
Fix by updating *chunks_p directly when backlink_p is NULL (first chunk realloc case).
Valgrind confirmed this eliminates the UAF errors.