pw_bluetooth_sapphire: Fix UAF in LogicalLink::SignalError Avoid a Use-After-Free (UAF) vulnerability by invoking the link error callback asynchronously. When all channels on a logical link are closed, SignalError invokes the link error callback. In LE fixed-channel-only links, this can happen synchronously, which in turn synchronously destroys the LogicalLink and its channels. Returning from SignalError (or the channel's SignalLinkError) would then execute on a destroyed object. By posting the error callback to the dispatcher using HeapDispatcher, we ensure that the LogicalLink is only destroyed after the call stack has completely unwound. Fixed: b/510065734 Fixed: b/535162699 Change-Id: I1463dd717982fa1b932a12aa6b0d1f34fc91e64a Reviewed-on: https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/482629
Pigweed is an open source collection of embedded-targeted libraries–or as we like to call them, modules. These modules are building blocks and infrastructure that enable faster and more reliable development on small-footprint MMU-less 32-bit microcontrollers like the STMicroelectronics STM32L452 or the Nordic nRF52832.
For more information please see our website: https://pigweed.dev/.