Skip to content

Commit

Permalink
Final round of review comments
Browse files Browse the repository at this point in the history
  • Loading branch information
ksperling-apple committed Mar 11, 2025
1 parent f7f5f73 commit 6fcbc70
Show file tree
Hide file tree
Showing 2 changed files with 3 additions and 48 deletions.
6 changes: 3 additions & 3 deletions src/darwin/Framework/CHIPTests/MTRBleTests.m
Original file line number Diff line number Diff line change
Expand Up @@ -137,9 +137,9 @@ - (void)testBleCommissionAfterStopBrowseUAF
XCTAssertTrue([sController stopBrowseForCommissionables]);

// Attempt to use the MTRCommissionableBrowserResult after we stopped browsing
// TODO: This currently results in a UAF because BLE_CONNECTION_OBJECT is a void*
// This used to result in a UAF because BLE_CONNECTION_OBJECT is a void*
// carrying a CBPeripheral without retaining it. When browsing is stopped,
// BleConnectionDelegateImpl release all cached CBPeripherals.
// BleConnectionDelegateImpl releases all cached CBPeripherals.
MTRSetupPayload * payload = [[MTRSetupPayload alloc] initWithSetupPasscode:@54321 discriminator:@0x444];
[sController setupCommissioningSessionWithDiscoveredDevice:device
payload:payload
Expand All @@ -157,7 +157,7 @@ - (void)testShutdownBlePowerOffRaceUAF
XCTAssertTrue([sController setupCommissioningSessionWithPayload:payload newNodeID:@999 error:&error],
"setupCommissioningSessionWithPayload failed: %@", error);

// Create a race between shutdown and a CBManager callback that provokes a UAF
// Create a race between shutdown and a CBManager callback that used to provoke a UAF.
// Note that on the order of 100 iterations can be necessary to reproduce the crash.
__block atomic_int tasks = 2;
dispatch_semaphore_t done = dispatch_semaphore_create(0);
Expand Down
45 changes: 0 additions & 45 deletions src/platform/Darwin/BlePeripheral.h

This file was deleted.

0 comments on commit 6fcbc70

Please sign in to comment.