summaryrefslogtreecommitdiff
path: root/common/usbx_host_classes/src/ux_host_class_hid_entry.c
AgeCommit message (Collapse)Author
2026-06-04fix(hid): fixed memory leak and double-free in keyboard/mouse/remote_control ↵Frédéric Desbiens
client lifecycle (#265) PR #262 introduced per-instance UX_HOST_CLASS_HID_CLIENT allocation in client_search.c. However, keyboard/mouse/remote_control activate handlers already embed a UX_HOST_CLASS_HID_CLIENT inside their own combined allocation (e.g. UX_HOST_CLASS_HID_CLIENT_KEYBOARD), override hid->hid_client with the embedded copy, and then free the entire combined struct (as 'keyboard_instance', the first field) during deactivation. This created two bugs: 1. Memory leak: the per-instance copy from client_search was abandoned when activate handlers replaced hid->hid_client with their embedded copy. 2. Double-free / UX_MEMORY_CORRUPTED: deactivate.c freed hid->hid_client after calling the handler, but for keyboard/mouse/remote_control the deactivate handler had already freed the entire combined allocation (which contains the embedded hid_client), causing a second free of a pointer into the middle of a now-freed block. Fix: - keyboard/mouse/remote_control activate: free the per-instance copy from client_search before overriding hid->hid_client with the embedded one. - keyboard/mouse/remote_control deactivate: null hid->hid_client after freeing the combined struct, signalling that cleanup is done. - deactivate.c: re-check hid_client != NULL after calling the handler before freeing; keyboard/mouse/remote_control will have nulled it, simple clients will not. - keyboard/mouse ACTIVATE_WAIT error paths (standalone): null hid->hid_client after freeing the combined struct so that the generic cleanup in entry.c skips the already-freed pointer. - entry.c standalone ACTIVATE_WAIT error: guard the free with a NULL check to safely handle both cases. Discovered while investigating test failures introduced by PR #262. All 430 tests pass after this fix. Co-authored-by: Copilot <[email protected]>
2026-06-04fix(hid): Store client instance per-device instead of per-class (#262)Kajtek Lau
* fix(hid): Store client instance per-device instead of per-class * Address review feedback on per-instance HID client copy Three issues fixed, discovered during maintainer review: 1. Memory leak in standalone activation error path (entry.c): _ux_host_class_hid_client_activate_wait() set hid_client to NULL without freeing the per-instance copy allocated in client_search. The HID_ENUM_ERROR handler destroys the hid struct without freeing hid_client, so the copy was leaked on every standalone activation failure. Fixed by freeing hid_client before clearing it. 2. Variable declared inside if-block (client_search.c): hid_client_instance was declared inside the if (status == UX_SUCCESS) block, which is a C99 feature. USBX targets C89/C90 embedded toolchains. Moved to the top of the function with other locals. 3. Trailing whitespace throughout both changed files: The PR introduced trailing spaces on most comment-block lines. Reverted all affected lines to their original whitespace. Co-authored-by: Copilot <[email protected]> --------- Co-authored-by: Frédéric Desbiens <[email protected]> Co-authored-by: Copilot <[email protected]>
2026-03-05Fixed issue where pointer size was used instead of buffer size in ↵Frédéric Desbiens
ux_host_class_hid_report_item_analyse
2026-03-05Updated copyright headers and removed trailing whitespaceFrédéric Desbiens
2024-01-29Update copyright.Bo Chen (from Dev Box)
2022-07-26Release 6.1.12v6.1.12_relYuxin Zhou
2022-01-26Release 6.1.10v6.1.10_relYuxin Zhou
2020-10-096.1 Releasev6.1_relScott Larson
2020-05-11Initial commitPProvost