From: Sascha Hauer <s.hauer@pengutronix.de>
To: barebox@lists.infradead.org, a.fatoum@pengutronix.de,
Johannes Schneider <johannes.schneider@leica-geosystems.com>
Cc: thomas.haemmerle@leica-geosystems.com
Subject: Re: [PATCH v2] lib: gui: png_pico: fix use-after-free and double-free in png_open
Date: Thu, 18 Jun 2026 09:10:45 +0200 [thread overview]
Message-ID: <178176664565.3277071.3626992450320466900.b4-ty@pengutronix.de> (raw)
In-Reply-To: <20260604054047.2624155-1-johannes.schneider@leica-geosystems.com>
On Thu, 04 Jun 2026 05:40:47 +0000, Johannes Schneider wrote:
> png_open() set img->data from png_info->image->data and then called
> png_alloc_free_all(), which freed every buffer the picopng allocator
> tracks -- including the decoded pixel buffer. Callers held a
> dangling img->data, and the later png_close() free()'d it again.
>
> Add png_alloc_detach() to drop a tracked address from the allocator
> without freeing it, transferring ownership to the caller, and use it
> in png_open() before png_alloc_free_all() runs.
>
> [...]
Applied, thanks!
[1/1] lib: gui: png_pico: fix use-after-free and double-free in png_open
https://git.pengutronix.de/cgit/barebox/commit/?id=b94f31ff9f3a (link may not be stable)
Best regards,
--
Sascha Hauer <s.hauer@pengutronix.de>
prev parent reply other threads:[~2026-06-18 7:13 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-04 5:40 Johannes Schneider
2026-06-18 7:10 ` Sascha Hauer [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178176664565.3277071.3626992450320466900.b4-ty@pengutronix.de \
--to=s.hauer@pengutronix.de \
--cc=a.fatoum@pengutronix.de \
--cc=barebox@lists.infradead.org \
--cc=johannes.schneider@leica-geosystems.com \
--cc=thomas.haemmerle@leica-geosystems.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox