firmware: Use-after-free bug in clock.c
The memory of the timeout
variable is freed after return from the clock_init()
function. However, this memory is written to by the timer module once the timer has expired.
The memory of the timeout
variable is freed after return from the clock_init()
function. However, this memory is written to by the timer module once the timer has expired.