From 1b8a830a38caf393cb308ad206d3c23329d58a48 Mon Sep 17 00:00:00 2001
From: Andrew Tridgell <andrew@tridgell.net>
Date: Sat, 14 Feb 2015 10:22:55 +1100
Subject: i2c: prevent double free of _dev pointer

this caused heap corruption
---
 src/drivers/device/i2c.cpp | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

(limited to 'src')

diff --git a/src/drivers/device/i2c.cpp b/src/drivers/device/i2c.cpp
index 33bb90fc9..092ecd144 100644
--- a/src/drivers/device/i2c.cpp
+++ b/src/drivers/device/i2c.cpp
@@ -74,8 +74,10 @@ I2C::I2C(const char *name,
 
 I2C::~I2C()
 {
-	if (_dev)
+	if (_dev) {
 		up_i2cuninitialize(_dev);
+		_dev = nullptr;
+	}
 }
 
 int
@@ -118,6 +120,7 @@ I2C::init()
 	// is smaller than the bus frequency
 	if (_bus_clocks[bus_index] > _frequency) {
 		(void)up_i2cuninitialize(_dev);
+		_dev = nullptr;
 		log("FAIL: too slow for bus #%u: %u KHz, device max: %u KHz)",
 			_bus, _bus_clocks[bus_index] / 1000, _frequency / 1000);
 		ret = -EINVAL;
@@ -164,6 +167,7 @@ I2C::init()
 out:
 	if ((ret != OK) && (_dev != nullptr)) {
 		up_i2cuninitialize(_dev);
+		_dev = nullptr;
 	}
 	return ret;
 }
-- 
cgit v1.2.3