Skip to content

Fix use-after-free in the FreeRTOS mDNS backend#30

Merged
mansandersson merged 3 commits into
NIBEGroup:mainfrom
d-serj:bugfix/ship_mdns_freertos
Jun 18, 2026
Merged

Fix use-after-free in the FreeRTOS mDNS backend#30
mansandersson merged 3 commits into
NIBEGroup:mainfrom
d-serj:bugfix/ship_mdns_freertos

Conversation

@d-serj

@d-serj d-serj commented Jun 14, 2026

Copy link
Copy Markdown
Contributor

Issue:
When an mdns search finished, the FreeRTOS backend passed its own found_entries vector straight to the on_entries_found callback. But that callback takes ownership: it processes entries and frees the vector. So the mdns backend kept using a vector that had already been freed.

Fix:
Add MdnsNotifyFoundEntries() which copies the entries into a new vector and passes that to the ship_node callback (the same approach used in ship_mdns_bonjour.c)

Other updates:
Remove unused include from src/ship/mdns/ship_mdns_bonjour.c
Fix FreeRTOS.h include in src/common/eebus_malloc.h

@mansandersson mansandersson merged commit 44572d8 into NIBEGroup:main Jun 18, 2026
5 checks passed
@mansandersson

Copy link
Copy Markdown
Contributor

Thank you for your contribution

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants