(mynewt-core) branch master updated: at45db: fix leaked settings and corrupted global default baudrate

[janc]

This is an automated email from the ASF dual-hosted git repository.

sjanc pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/mynewt-core.git


The following commit(s) were added to refs/heads/master by this push:
     new ffab3980b at45db: fix leaked settings and corrupted global default 
baudrate
ffab3980b is described below

commit ffab3980b5cd9bc2b5e7c075025a022b94391fac
Author: Ray Chern <87560781+94...@users.noreply.github.com>
AuthorDate: Sat Aug 1 01:11:29 2026 +0800

    at45db: fix leaked settings and corrupted global default baudrate
    
    at45db_init()'s non-default-baudrate path allocated a per-device copy
    of hal_spi_settings but never used it correctly:
    
        settings = malloc(sizeof(at45db_default_settings));
        ...
        memcpy(settings, &at45db_default_settings, 
sizeof(at45db_default_settings));
        at45db_default_settings.baudrate = dev->baudrate;
    
    This has two problems:
    
    1. dev->settings is never assigned in this branch (only the default
       branch does `dev->settings = &at45db_default_settings`), so the
       later `hal_spi_config(dev->spi_num, dev->settings)` call is passed
       an unset/stale pointer for every device using a non-default
       baudrate. The allocated `settings` buffer itself leaks - the only
       pointer to it (the local variable) goes out of scope at the end of
       the function.
    
    2. The baudrate is written into the *global* at45db_default_settings
       instead of the per-device copy, corrupting the shared default for
       every other at45db device initialized afterwards.
    
    Fix: store the baudrate on the allocated copy (not the global), assign
    the copy to dev->settings, and free it on the two error paths that
    follow (hal_spi_init()/hal_spi_config() failing) so the allocation
    doesn't leak there either. `settings` is initialized to NULL so
    free(settings) is a safe no-op on the default-baudrate path, where no
    allocation happens.
    
    Per the ASF's generative-tooling policy
    (https://www.apache.org/legal/generative-tooling.html), noting tool
    usage in the commit message is a recommended (not required) practice.
    
    Generated-by: Claude (Anthropic)
    
    Signed-off-by: yi chen <94x...@gmail.com>
---
 hw/drivers/flash/at45db/src/at45db.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/hw/drivers/flash/at45db/src/at45db.c 
b/hw/drivers/flash/at45db/src/at45db.c
index 23a446401..2510a3ade 100644
--- a/hw/drivers/flash/at45db/src/at45db.c
+++ b/hw/drivers/flash/at45db/src/at45db.c
@@ -416,7 +416,7 @@ int
 at45db_init(const struct hal_flash *hal_flash_dev)
 {
     int rc;
-    struct hal_spi_settings *settings;
+    struct hal_spi_settings *settings = NULL;
     struct at45db_dev *dev;
 
     dev = (struct at45db_dev *) hal_flash_dev;
@@ -430,18 +430,21 @@ at45db_init(const struct hal_flash *hal_flash_dev)
             return -1;
         }
         memcpy(settings, &at45db_default_settings, 
sizeof(at45db_default_settings));
-        at45db_default_settings.baudrate = dev->baudrate;
+        settings->baudrate = dev->baudrate;
+        dev->settings = settings;
     }
 
     hal_gpio_init_out(dev->ss_pin, 1);
 
     rc = hal_spi_init(dev->spi_num, dev->spi_cfg, HAL_SPI_TYPE_MASTER);
     if (rc) {
+        free(settings);
         return (rc);
     }
 
     rc = hal_spi_config(dev->spi_num, dev->settings);
     if (rc) {
+        free(settings);
         return (rc);
     }