search

esp-rs / esp-idf-hal

embedded-hal implementation for Rust on ESP32 and ESP-IDF
https://docs.esp-rs.org/esp-idf-hal/
Apache License 2.0
473 stars 172 forks source link

Possible use after free in TxRmtDriver #285

Open schurwanzn-stabl opened 1 year ago

schurwanzn-stabl commented 1 year ago

When TxRmtDriver::write_items is called with block = false https://github.com/esp-rs/esp-idf-hal/blob/29806afcd3fc87759825d4da6895e473ca0c4e68/src/rmt.rs#L607-L613 the called function rmt_write_items will keep reading from the passed pointer until the transmission is completed. The borrow on the S: Signal though "expires" once write_items returns. For example when calling the TxRmtDriver::start function https://github.com/esp-rs/esp-idf-hal/blob/29806afcd3fc87759825d4da6895e473ca0c4e68/src/rmt.rs#L589-L597 the ESP-IDF may access dropped memory.

Aside from that the documentation of rm_write_items states to "please [?] do not use the memory allocated from psram when calling rmt_write_items". This restriction is not enforced either. Should I create a separate issue for this?

ivmarkov commented 1 year ago

Can you actually contribute a Pr that fixes this? I admit I did not review carefully the RMT driver at the time, and it was a contribution.

schurwanzn-stabl commented 1 year ago

Fixing the code seems a bit more involved and we currently do not use the non-blocking function. Thus I can't contribute a fix for now, sorry.