[BRLTTY] Crash of BRLTTY in X sessionudo systemctl edit brlpulse

[Dave Mielke]

[quoted lines by Samuel Thibault on 2025/02/27 at 21:54 +0100]

>I believe we have the information:
>
>> ==208649==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c0019f8101 at pc 0x55de2ae390a3 bp 0x7fff172e34a0 sp 0x7fff172e3498
>> READ of size 1 at 0x60c0019f8101 thread T0
>>     #0 0x55de2ae390a2 in usbCancelRequest ??:?
>
>This is the urb->endpoint read. We are trying to cancel a request but it
>was already freed.

Sebastian: Please test the attached patch.

-- 
I believe the Bible to be the very Word of God: http://Mielke.cc/bible/
Dave Mielke            | 2213 Fox Crescent | WebHome: http://Mielke.cc/
EMail: Dave at Mielke.cc  | Ottawa, Ontario   | Twitter: @Dave_Mielke
Phone: +1 613 726 0014 | Canada  K2A 1H7   |

http://mielke.cc/xmother.html (Letter from a Feminist ex-Mother)
-------------- next part --------------
diff --git a/Programs/usb_linux.c b/Programs/usb_linux.c
index 45384d190..a8e751c4d 100644
--- a/Programs/usb_linux.c
+++ b/Programs/usb_linux.c
@@ -426,6 +426,12 @@ usbReapURB (UsbDevice *device, int wait) {
         if ((endpoint = usbGetEndpoint(device, urb->endpoint))) {
           UsbEndpointExtension *eptx = endpoint->extension;
 
+          switch (USB_ENDPOINT_DIRECTION(endpoint->descriptor)) {
+            case UsbEndpointDirection_Input:
+              deleteItem(endpoint->direction.input.pending.requests, urb);
+              break;
+          }
+
           if (enqueueItem(eptx->completedRequests, urb)) return endpoint;
           logSystemError("USB completed request enqueue");
           free(urb);
@@ -955,8 +961,6 @@ usbReadDeviceDescriptor (UsbDevice *device) {
 
 static int
 usbHandleInputURB (UsbEndpoint *endpoint, struct usbdevfs_urb *urb) {
-  deleteItem(endpoint->direction.input.pending.requests, urb);
-
   if (urb->actual_length < 0) {
     usbLogInputProblem(endpoint, "data not available");
     return 0;