From f93d7de846935ba5bf998b26befb0740ea04a548 Mon Sep 17 00:00:00 2001 From: Vivien Nicolas Date: Thu, 24 Oct 2024 11:52:38 +0200 Subject: [PATCH 1/2] [chip-tool[darwin-framework-tool] Using a malformed ComplexArgument may result into a leak --- examples/chip-tool/commands/clusters/ComplexArgument.h | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/examples/chip-tool/commands/clusters/ComplexArgument.h b/examples/chip-tool/commands/clusters/ComplexArgument.h index 6f92256ff735e4..a8cefc801e0dd0 100644 --- a/examples/chip-tool/commands/clusters/ComplexArgument.h +++ b/examples/chip-tool/commands/clusters/ComplexArgument.h @@ -181,7 +181,12 @@ class ComplexArgumentParser // - 11 is the maximum length of a %d (-2147483648, 2147483647) // - 2 is the length for the "[" and "]" characters. snprintf(labelWithIndex, sizeof(labelWithIndex), "%.241s[%d]", label, i); - ReturnErrorOnFailure(ComplexArgumentParser::Setup(labelWithIndex, content[i], value[i])); + auto error = ComplexArgumentParser::Setup(labelWithIndex, content[i], value[i]); + if (CHIP_NO_ERROR != error) + { + chip::Platform::MemoryFree(content); + return error; + } } request = chip::app::DataModel::List(content, value.size()); From 7e75b690a109e487fe82826296e968eff0ac8fec Mon Sep 17 00:00:00 2001 From: Vivien Nicolas Date: Thu, 24 Oct 2024 16:11:34 +0200 Subject: [PATCH 2/2] [chip-tool[darwin-framework-tool] Even on success the ComplexArgument may not be cleared properly --- examples/chip-tool/commands/clusters/ComplexArgument.h | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/examples/chip-tool/commands/clusters/ComplexArgument.h b/examples/chip-tool/commands/clusters/ComplexArgument.h index a8cefc801e0dd0..695af2f764a9c1 100644 --- a/examples/chip-tool/commands/clusters/ComplexArgument.h +++ b/examples/chip-tool/commands/clusters/ComplexArgument.h @@ -420,7 +420,14 @@ class TypedComplexArgument : public ComplexArgument return ComplexArgumentParser::Setup(label, *mRequest, value); } - void Reset() { *mRequest = T(); } + void Reset() + { + if (mRequest != nullptr) + { + ComplexArgumentParser::Finalize(*mRequest); + *mRequest = T(); + } + } private: T * mRequest;