From 8234a3614e289945cf425e3fcca3979f99a17422 Mon Sep 17 00:00:00 2001
From: Hui Su <3164683437@qq.com>
Date: Wed, 19 Aug 2026 13:42:55 +0800
Subject: [PATCH] [kernel/memheap] fix: stop invalid frees from corrupting heap

RT_ASSERT() does not stop execution when RT_DEBUGING_ASSERT is disabled.
Return after the existing block validation so a sequential duplicate free
cannot update heap accounting or the free list in release builds.

Before fix:
  memheap double-free used: before=64 alloc=224 free=64 after=4294959232

Validation:
scons -C bsp/qemu-vexpress-a9 -j$(nproc)

Signed-off-by: Hui Su <3164683437@qq.com>
---
 src/memheap.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/memheap.c b/src/memheap.c
index b466acb437..1c7d1de0ed 100644
--- a/src/memheap.c
+++ b/src/memheap.c
@@ -619,6 +619,7 @@ void rt_memheap_free(void *ptr)
         RT_ASSERT(header_ptr->magic == (RT_MEMHEAP_MAGIC | RT_MEMHEAP_USED));
         /* check whether this block of memory has been over-written. */
         RT_ASSERT((header_ptr->next->magic & RT_MEMHEAP_MASK) == RT_MEMHEAP_MAGIC);
+        return;
     }
 
     /* get pool ptr */