Skip to content

Commit 3de7b77

Browse files
fix: deep-copy security_options in rmw_init_options_copy to prevent double-free (#6)
1 parent 74f4cf0 commit 3de7b77

1 file changed

Lines changed: 9 additions & 0 deletions

File tree

‎rmw_unix_socket_cpp/src/rmw_init.cpp‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
#include "rmw/init.h"
1111
#include "rmw/init_options.h"
1212
#include "rmw/rmw.h"
13+
#include "rmw/security_options.h"
1314

1415
extern "C"
1516
{
@@ -48,6 +49,14 @@ rmw_ret_t rmw_init_options_copy(
4849
return RMW_RET_INVALID_ARGUMENT;
4950
}
5051
*dst = *src;
52+
// security_options.security_root_path is heap-owned; deep-copy it so src and
53+
// dst don't alias the same pointer and double-free in rmw_init_options_fini.
54+
dst->security_options = rmw_get_zero_initialized_security_options();
55+
rmw_ret_t ret = rmw_security_options_copy(
56+
&src->security_options, &src->allocator, &dst->security_options);
57+
if (ret != RMW_RET_OK) {
58+
return ret;
59+
}
5160
if (src->enclave) {
5261
dst->enclave = rcutils_strdup(src->enclave, src->allocator);
5362
}

0 commit comments

Comments
 (0)