Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0820dacc authored by Rahul Arya's avatar Rahul Arya Committed by Cherrypicker Worker
Browse files

Fix use-after-free in HID callback 

Caused crashlooping on MTE builds.

Ignore-AOSP-First: security
Test: manual
Bug: 281346084
(cherry picked from commit 063d2966)
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:152913742eedf1cab590c76f4dddf3b4e686994a)
Merged-In: I94ecdfe3f091a2b2969471c316035e3cea64773c
Change-Id: I94ecdfe3f091a2b2969471c316035e3cea64773c
parent 9f5e34ef

system/btif/src/btif_hh.cc

+3 −3
Original line number Diff line number Diff line
@@ -614,11 +614,11 @@ bt_status_t btif_hh_connect(const RawAddress* bd_addr) { 
  BTA_HhOpen(*bd_addr);



  do_in_jni_thread(base::Bind(

      [](RawAddress* bd_addr) {

        HAL_CBACK(bt_hh_callbacks, connection_state_cb, bd_addr,

      [](RawAddress bd_addr) {

        HAL_CBACK(bt_hh_callbacks, connection_state_cb, &bd_addr,

                  BTHH_CONN_STATE_CONNECTING);

      },

      (RawAddress*)bd_addr));

      *bd_addr));

  return BT_STATUS_SUCCESS;

}