requester: Fix null deref and memory leak in async effecter set_state_effecter_async performs placement new on responseMsg before checking whether recvMsg() succeeded. On failure responseMsg remains nullptr, resulting in undefined behavior. The mismatch path also leaks responseMsg. Check recvMsg() before placement new, free responseMsg on mismatch, initialize srcTid, and log errors in both failure paths. Change-Id: Iae602135b4683a8d294c93b5cc23bdbcfe088d40 Signed-off-by: Gary Beihl <garybeihl@microsoft.com>
diff --git a/utilities/requester/set_state_effecter_async.cpp b/utilities/requester/set_state_effecter_async.cpp index 0a1f2e8..fc054d6 100644 --- a/utilities/requester/set_state_effecter_async.cpp +++ b/utilities/requester/set_state_effecter_async.cpp
@@ -63,12 +63,21 @@ void* responseMsg = nullptr; size_t responseMsgSize{}; - pldm_tid_t srcTid; + pldm_tid_t srcTid = 0; auto rc = pldmTransport.recvMsg(srcTid, responseMsg, responseMsgSize); + if (rc) + { + error("Failed to receive PLDM response, rc={RC}", "RC", rc); + return; + } pldm_msg* response = new (responseMsg) pldm_msg; - if (rc || dstTid != srcTid || + if (dstTid != srcTid || !pldm_msg_hdr_correlate_response(&request->hdr, &response->hdr)) { + error( + "Unexpected PLDM response, received TID={RTID} expected TID={ETID}", + "RTID", srcTid, "ETID", dstTid); + free(responseMsg); return; }