Issue
In hal_esp32_i2c.c (i2c_master driver, ESP-IDF ≥ 5.2) functions hal_i2c_send() and hal_i2c_receive() use i2c_master_bus_rm_device() but they do not assign NULL to the pointer pointing the freed memory, leaving it dangling (lines 252, 319). At the same time, hal_i2c_release() checks for non-NULL value of hal->dev_handle before calling i2c_master_bus_rm_device, leading to double free (line 342).
Observed Imact
While working with ESP32-C6 the bug lead to heap poisoning.
Suggested fix
My suggestion is to add a NULL assignment to each pointer given as argument to i2c_master_bus_rm_device() just after calling the function (function called in lines 252, 319, 343). Will follow up with a PR.
Issue
In hal_esp32_i2c.c (i2c_master driver, ESP-IDF ≥ 5.2) functions
hal_i2c_send()andhal_i2c_receive()usei2c_master_bus_rm_device()but they do not assign NULL to the pointer pointing the freed memory, leaving it dangling (lines 252, 319). At the same time,hal_i2c_release()checks for non-NULL value ofhal->dev_handlebefore callingi2c_master_bus_rm_device, leading to double free (line 342).Observed Imact
While working with ESP32-C6 the bug lead to heap poisoning.
Suggested fix
My suggestion is to add a NULL assignment to each pointer given as argument to
i2c_master_bus_rm_device()just after calling the function (function called in lines 252, 319, 343). Will follow up with a PR.