From 22459231905f17ac0b919a2e7c04d601a61182c5 Mon Sep 17 00:00:00 2001 From: Abderahmane BENALI Date: Tue, 2 Jun 2026 13:05:00 +0200 Subject: [PATCH] fix: deep-copy security_options in rmw_init_options_copy to prevent double-free --- rmw_unix_socket_cpp/src/rmw_init.cpp | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/rmw_unix_socket_cpp/src/rmw_init.cpp b/rmw_unix_socket_cpp/src/rmw_init.cpp index ddfaf1b..add0700 100644 --- a/rmw_unix_socket_cpp/src/rmw_init.cpp +++ b/rmw_unix_socket_cpp/src/rmw_init.cpp @@ -10,6 +10,7 @@ #include "rmw/init.h" #include "rmw/init_options.h" #include "rmw/rmw.h" +#include "rmw/security_options.h" extern "C" { @@ -48,6 +49,14 @@ rmw_ret_t rmw_init_options_copy( return RMW_RET_INVALID_ARGUMENT; } *dst = *src; + // security_options.security_root_path is heap-owned; deep-copy it so src and + // dst don't alias the same pointer and double-free in rmw_init_options_fini. + dst->security_options = rmw_get_zero_initialized_security_options(); + rmw_ret_t ret = rmw_security_options_copy( + &src->security_options, &src->allocator, &dst->security_options); + if (ret != RMW_RET_OK) { + return ret; + } if (src->enclave) { dst->enclave = rcutils_strdup(src->enclave, src->allocator); }