已合并
[OpenHarmony-5.1.0-Release]漏洞修复：vul-1077795561442119680、vul-1077795361088606208 #9248
h60106262创建于 8月6日
[OpenHarmony-5.1.0-Release]漏洞修复：vul-1077795561442119680、vul-1077795361088606208 #9248
已合并
从已删除 :OpenHarmony-5.1.0-Release合入到openharmony/drivers_peripheralOpenHarmony-5.1.0-Release
共 3 个文件变更+24-12
| @@ -202,15 +202,19 @@ int32_t UsbDeviceImpl::BindUsbdDeviceSubscriber(const sptr<IUsbdSubscriber> &sub | |||
| 202 | subscribers_[i].usbPnpListener.callBack = UsbdPnpLoaderEventReceived; | 202 | subscribers_[i].usbPnpListener.callBack = UsbdPnpLoaderEventReceived; |
| 203 | subscribers_[i].usbPnpListener.priv = &subscribers_[i]; | 203 | subscribers_[i].usbPnpListener.priv = &subscribers_[i]; |
| 204 | subscribers_[i].remote = remote; | 204 | subscribers_[i].remote = remote; |
| 205 | - subscribers_[i].deathRecipient = new UsbDeviceImpl::UsbDeathRecipient(subscriber); | 205 | + auto *recipient = new UsbDeviceImpl::UsbDeathRecipient(subscriber); |
| 206 | - if (subscribers_[i].deathRecipient == nullptr) { | 206 | + if (recipient == nullptr) { |
| 207 | HDF_LOGE("%{public}s: new deathRecipient failed", __func__); | 207 | HDF_LOGE("%{public}s: new deathRecipient failed", __func__); |
| 208 | + subscribers_[i].subscriber = nullptr; | ||
| 208 | return HDF_FAILURE; | 209 | return HDF_FAILURE; |
| 209 | } | 210 | } |
| 210 | - bool result = subscribers_[i].remote->AddDeathRecipient( | 211 | + subscribers_[i].deathRecipient = recipient; |
| 211 | - static_cast<UsbDeathRecipient *>(subscribers_[i].deathRecipient)); | 212 | + bool result = subscribers_[i].remote->AddDeathRecipient(recipient); |
| 212 | if (!result) { | 213 | if (!result) { |
| 213 | HDF_LOGE("%{public}s:AddUsbDeathRecipient failed", __func__); | 214 | HDF_LOGE("%{public}s:AddUsbDeathRecipient failed", __func__); |
| 215 | + delete recipient; | ||
| 216 | + subscribers_[i].deathRecipient = nullptr; | ||
| 217 | + subscribers_[i].subscriber = nullptr; | ||
| 214 | return HDF_FAILURE; | 218 | return HDF_FAILURE; |
| 215 | } | 219 | } |
| 216 | 220 | ||
| @@ -2273,15 +2273,19 @@ int32_t UsbImpl::BindUsbdSubscriber(const sptr<IUsbdSubscriber> &subscriber) | |||
| 2273 | subscribers_[i].usbPnpListener.callBack = UsbdPnpLoaderEventReceived; | 2273 | subscribers_[i].usbPnpListener.callBack = UsbdPnpLoaderEventReceived; |
| 2274 | subscribers_[i].usbPnpListener.priv = &subscribers_[i]; | 2274 | subscribers_[i].usbPnpListener.priv = &subscribers_[i]; |
| 2275 | subscribers_[i].remote = remote; | 2275 | subscribers_[i].remote = remote; |
| 2276 | - subscribers_[i].deathRecipient = new UsbImpl::UsbDeathRecipient(subscriber); | 2276 | + auto *recipient = new UsbImpl::UsbDeathRecipient(subscriber); |
| 2277 | - if (subscribers_[i].deathRecipient == nullptr) { | 2277 | + if (recipient == nullptr) { |
| 2278 | HDF_LOGE("%{public}s: new deathRecipient failed", __func__); | 2278 | HDF_LOGE("%{public}s: new deathRecipient failed", __func__); |
| 2279 | + subscribers_[i].subscriber = nullptr; | ||
| 2279 | return HDF_FAILURE; | 2280 | return HDF_FAILURE; |
| 2280 | } | 2281 | } |
| 2281 | - bool result = subscribers_[i].remote->AddDeathRecipient( | 2282 | + subscribers_[i].deathRecipient = recipient; |
| 2282 | - static_cast<UsbDeathRecipient *>(subscribers_[i].deathRecipient)); | 2283 | + bool result = subscribers_[i].remote->AddDeathRecipient(recipient); |
| 2283 | if (!result) { | 2284 | if (!result) { |
| 2284 | HDF_LOGE("%{public}s:AddUsbDeathRecipient failed", __func__); | 2285 | HDF_LOGE("%{public}s:AddUsbDeathRecipient failed", __func__); |
| 2286 | + delete recipient; | ||
| 2287 | + subscribers_[i].deathRecipient = nullptr; | ||
| 2288 | + subscribers_[i].subscriber = nullptr; | ||
| 2285 | return HDF_FAILURE; | 2289 | return HDF_FAILURE; |
| 2286 | } | 2290 | } |
| 2287 | 2291 | ||
| @@ -164,15 +164,19 @@ int32_t UsbPortImpl::BindUsbdPortSubscriber(const sptr<IUsbdSubscriber> &subscri | |||
| 164 | subscribers_[i].usbPnpListener.callBack = UsbdPnpLoaderEventReceived; | 164 | subscribers_[i].usbPnpListener.callBack = UsbdPnpLoaderEventReceived; |
| 165 | subscribers_[i].usbPnpListener.priv = &subscribers_[i]; | 165 | subscribers_[i].usbPnpListener.priv = &subscribers_[i]; |
| 166 | subscribers_[i].remote = remote; | 166 | subscribers_[i].remote = remote; |
| 167 | - subscribers_[i].deathRecipient = new UsbPortImpl::UsbDeathRecipient(subscriber); | 167 | + auto *recipient = new UsbPortImpl::UsbDeathRecipient(subscriber); |
| 168 | - if (subscribers_[i].deathRecipient == nullptr) { | 168 | + if (recipient == nullptr) { |
| 169 | HDF_LOGE("%{public}s: new deathRecipient failed", __func__); | 169 | HDF_LOGE("%{public}s: new deathRecipient failed", __func__); |
| 170 | + subscribers_[i].subscriber = nullptr; | ||
| 170 | return HDF_FAILURE; | 171 | return HDF_FAILURE; |
| 171 | } | 172 | } |
| 172 | - bool result = subscribers_[i].remote->AddDeathRecipient( | 173 | + subscribers_[i].deathRecipient = recipient; |
| 173 | - static_cast<UsbDeathRecipient *>(subscribers_[i].deathRecipient)); | 174 | + bool result = subscribers_[i].remote->AddDeathRecipient(recipient); |
| 174 | if (!result) { | 175 | if (!result) { |
| 175 | HDF_LOGE("%{public}s:AddUsbDeathRecipient failed", __func__); | 176 | HDF_LOGE("%{public}s:AddUsbDeathRecipient failed", __func__); |
| 177 | + delete recipient; | ||
| 178 | + subscribers_[i].deathRecipient = nullptr; | ||
| 179 | + subscribers_[i].subscriber = nullptr; | ||
| 176 | return HDF_FAILURE; | 180 | return HDF_FAILURE; |
| 177 | } | 181 | } |
| 178 | 182 | ||