From 6e2818b0a75fbfbb56f11b93e811c7e1d15e52cf Mon Sep 17 00:00:00 2001 From: Vivien Nicolas Date: Tue, 19 Apr 2022 15:55:21 +0200 Subject: [PATCH] AddressSanitizer: heap-use-after-free in chip::Controller::DeviceCommissioner::CommissioningStageComplete --- src/controller/CHIPDeviceController.cpp | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/src/controller/CHIPDeviceController.cpp b/src/controller/CHIPDeviceController.cpp index b1ce32d14d9db5..418cf48f6e6555 100644 --- a/src/controller/CHIPDeviceController.cpp +++ b/src/controller/CHIPDeviceController.cpp @@ -1553,12 +1553,6 @@ void DeviceCommissioner::OnDeviceConnectionFailureFn(void * context, PeerId peer ChipLogError(Controller, "Device connection failed without a valid error code. Making one up."); error = CHIP_ERROR_INTERNAL; } - // TODO: Determine if we really want the PASE session removed here. See #16089. - CommissioneeDeviceProxy * commissionee = commissioner->FindCommissioneeDevice(peerId.GetNodeId()); - if (commissionee != nullptr) - { - commissioner->ReleaseCommissioneeDevice(commissionee); - } commissioner->mSystemState->CASESessionMgr()->ReleaseSession(peerId); if (commissioner->mCommissioningStage == CommissioningStage::kFindOperational && @@ -1570,6 +1564,13 @@ void DeviceCommissioner::OnDeviceConnectionFailureFn(void * context, PeerId peer { commissioner->mPairingDelegate->OnPairingComplete(error); } + + CommissioneeDeviceProxy * commissionee = commissioner->FindCommissioneeDevice(peerId.GetNodeId()); + // TODO: Determine if we really want the PASE session removed here. See #16089. + if (commissionee != nullptr) + { + commissioner->ReleaseCommissioneeDevice(commissionee); + } } // ClusterStateCache::Callback impl