Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 309bc9a5 authored Jul 17, 2017 by Pavlin Radoslavov

Free p_pending_data from tBNEP_CONN to avoid potential memory leaks

Bug: 63146105
Test: External script
Change-Id: I1281779ccf38d1d2dfb1a6dc0e45c0e533cabbca
Merged-In: I1281779ccf38d1d2dfb1a6dc0e45c0e533cabbca
(cherry picked from commit 4982eb5df30cbcbee5c8b8807be95fdc6dfa63c5)
(cherry picked from commit b618a14f)
(cherry picked from commit 64a12d3b6e71d9161837f28ce18c34d924c2bafc)

parent 45db9edf

system/stack/bnep/bnep_main.c

+2 −0

Original line number	Original line	Diff line number	Diff line
	@@ -565,6 +565,8 @@ static void bnep_data_ind (UINT16 l2cap_cid, BT_HDR *p_buf)
	p_bcb->con_state != BNEP_STATE_CONNECTED &&		p_bcb->con_state != BNEP_STATE_CONNECTED &&
	extension_present && p && rem_len)		extension_present && p && rem_len)
	{		{
			if (p_bcb->p_pending_data)
			GKI_freebuf (p_bcb->p_pending_data);
	p_bcb->p_pending_data = (BT_HDR *)GKI_getbuf (rem_len + sizeof(BT_HDR));		p_bcb->p_pending_data = (BT_HDR *)GKI_getbuf (rem_len + sizeof(BT_HDR));
	if (p_bcb->p_pending_data)		if (p_bcb->p_pending_data)
	{		{

system/stack/bnep/bnep_utils.c

+2 −0

Original line number	Original line	Diff line number	Diff line
	@@ -150,6 +150,8 @@ void bnepu_release_bcb (tBNEP_CONN *p_bcb)

	/* Drop any response pointer we may be holding */		/* Drop any response pointer we may be holding */
	p_bcb->con_state = BNEP_STATE_IDLE;		p_bcb->con_state = BNEP_STATE_IDLE;
			if (p_bcb->p_pending_data)
			GKI_freebuf (p_bcb->p_pending_data);
	p_bcb->p_pending_data = NULL;		p_bcb->p_pending_data = NULL;

	/* Free transmit queue */		/* Free transmit queue */