From 092c0dfc31e66d8d8b269c65f2c3163e5b89906d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marco=20Trevisan=20=28Trevi=C3=B1o=29?= Date: Tue, 30 Jun 2026 13:13:22 +0200 Subject: [PATCH] fpcmoc: Copy the error before sending to the SSM The SSM error is stolen and then we pass to the resume/suspend callback potentially leading to a double-free. So copy it before re-using it. Reported by: Keith Linneman (LinnemanLabs) --- libfprint/drivers/fpcmoc/fpc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libfprint/drivers/fpcmoc/fpc.c b/libfprint/drivers/fpcmoc/fpc.c index 975dde15..6f976952 100644 --- a/libfprint/drivers/fpcmoc/fpc.c +++ b/libfprint/drivers/fpcmoc/fpc.c @@ -92,7 +92,7 @@ fpc_suspend_resume_cb (FpiUsbTransfer *transfer, if (ssm_state == FPC_CMD_SUSPENDED) { if (error) - fpi_ssm_mark_failed (transfer->ssm, error); + fpi_ssm_mark_failed (transfer->ssm, g_error_copy (error)); fpi_device_suspend_complete (device, error); /* The resume handler continues to the next state! */ @@ -100,7 +100,7 @@ fpc_suspend_resume_cb (FpiUsbTransfer *transfer, else if (ssm_state == FPC_CMD_RESUME) { if (error) - fpi_ssm_mark_failed (transfer->ssm, error); + fpi_ssm_mark_failed (transfer->ssm, g_error_copy (error)); else fpi_ssm_jump_to_state (transfer->ssm, FPC_CMD_GET_DATA);