[bluez/bluez] db4489: gobex: Fix use-after-free when cancelling SRM PUT ...

[bluez/bluez] db4489: gobex: Fix use-after-free when cancelling SRM PUT ...

[Rahul Samana]

  Branch: refs/heads/1122826
  Home:   https://github.com/bluez/bluez
  Commit: db448996954c22418d44421f704812cb891a6ae6
      https://github.com/bluez/bluez/commit/db448996954c22418d44421f704812cb891a6ae6
  Author: Rahul Samana <rahul.samana@oss.qualcomm.com>
  Date:   2026-07-07 (Tue, 07 Jul 2026)

  Changed paths:
    M gobex/gobex.c

  Log Message:
  -----------
  gobex: Fix use-after-free when cancelling SRM PUT transfer

In SRM mode put_get_data() queues the next packet during encoding of
the current one, so transfer->req_id and pending_req->id can diverge.
When g_obex_cancel_transfer() cancels the queued packet from tx_queue,
cancel_complete() frees the transfer while pending_req still holds a
callback pointing to it. Its G_OBEX_DEFAULT_TIMEOUT (10s) then fires
on freed memory causing a SIGSEGV.

Fix by clearing pending_req->rsp_func if it belongs to the same
transfer being cancelled.

Signed-off-by: Rahul Samana <rahul.samana@oss.qualcomm.com>



To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications