Linux: Fix Error Handling in TransportRpmsg_delete

TransportRpmsg_delete was not checking for a NULL handle
before de-referencing it, resulting in an application crash
if it was called with a NULL handle. A NULL handle was
being passed to TransportRpmsg_delete in the case where
TransportRpmsg_create socket connect call failed. In this
case, TransportRpmsg_create called TransportRpmsg_delete
with a NULL handle.

This patch adds a check for a NULL handle before de-referencing
the pointer in TransportRpmsg_delete, and also takes care
to cleanup the socket in TransportRpmsg_create in the failure
case where it cannot be cleaned by TransportRpmsg_delete.

Signed-off-by: Angela Stegmaier <angelabaker@ti.com>

1 files changed, 8 insertions, 0 deletions

diff --git a/linux/src/transport/TransportRpmsg.c b/linux/src/transport/TransportRpmsg.c
index 960b922..7eb3356 100644
--- a/linux/src/transport/TransportRpmsg.c
+++ b/linux/src/transport/TransportRpmsg.c
@@ -199,6 +199,8 @@ TransportRpmsg_Handle TransportRpmsg_create(TransportRpmsg_Params *params)
         fprintf(stderr,
                 "TransportRpmsg_create: connect failed: %d (%s) procId: %d\n",
                 errno, strerror(errno), params->rprocId);
+        close(sock);
+        TransportRpmsg_module->sock[clusterId] = INVALIDSOCKET;
         goto done;
     }
 
@@ -213,6 +215,8 @@ TransportRpmsg_Handle TransportRpmsg_create(TransportRpmsg_Params *params)
 
     if (obj == NULL) {
         status = Ipc_E_MEMORY;
+        close(sock);
+        TransportRpmsg_module->sock[clusterId] = INVALIDSOCKET;
         goto done;
     }
 
@@ -251,6 +255,9 @@ Void TransportRpmsg_delete(TransportRpmsg_Handle *pHandle)
     UInt16 clusterId;
     int sock;
 
+    if (obj == NULL) {
+        goto done;
+    }
 
     clusterId = obj->rprocId - MultiProc_getBaseIdOfCluster();
 
@@ -272,6 +279,7 @@ Void TransportRpmsg_delete(TransportRpmsg_Handle *pHandle)
         obj = NULL;
     }
 
+done:
     *pHandle = NULL;
 }