Segfault when using callbacks

Barney Stratford — Mon, 18 Apr 2022 18:05:03 -0000

The following causes a use-after-free bug:
RPi.GPIO.add_event_detect (channel, edge, callback = RPi.GPIO.remove_event_detect)

Look at the function run_py_callbacks starting at line 586 of source/py_gpio.c In the example given above, calling the callback in line 597 causes the memory pointed to by cb to be freed. If it is overwritten before line 605 (cb = cb->next), then cb goes into hyperspace and a segfault follows.

Recent changes to 204: Segfault when using callbacks

Segfault when using callbacks