Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4177e433 authored by Joseph Pirozzo's avatar Joseph Pirozzo
Browse files

Fix memory leak for BTRC_ITEM_MEDIA. 

Memory is allocated for each media item received from a remote phone for
AVRCP media browsing.  Although the media item itself was freed, the
memory for each attribute was not freed.  Move the allocation up to
the parent function such that it can be allocated and freed in the same
location.

Bug: 78222934
Test: dumpsys meminfo com.android.bluetooth
Change-Id: I217830441949642cd6ef0f96ac5fde9251452095
(cherry picked from commit c4a34b7f)
parent e4027feb

system/btif/src/btif_rc.cc

+22 −6
Original line number Diff line number Diff line
@@ -3885,6 +3885,10 @@ static void handle_get_folder_items_response(tBTA_AV_META_MSG* pmeta_msg, 
      switch (avrc_item->item_type) {

        case AVRC_ITEM_MEDIA:

          BTIF_TRACE_DEBUG("%s setting type to %d", __func__, BTRC_ITEM_MEDIA);

          /* Allocate Space for Attributes */

          btrc_item->media.num_attrs = avrc_item->u.media.attr_count;

          btrc_item->media.p_attrs = (btrc_element_attr_val_t*)osi_malloc(

              btrc_item->media.num_attrs * sizeof(btrc_element_attr_val_t));

          get_folder_item_type_media(avrc_item, btrc_item);

          break;
@@ -3910,7 +3914,22 @@ static void handle_get_folder_items_response(tBTA_AV_META_MSG* pmeta_msg, 
              (const btrc_folder_items_t*)btrc_items, item_count);

    BTIF_TRACE_DEBUG("%s HAL CBACK get_folder_items_cb finished", __func__);



    /* Release the memory block for items since we OWN the object */

    /* Release the memory block for items and attributes allocated here */

    for (uint8_t i = 0; i < item_count; i++) {

      btrc_folder_items_t* btrc_item = &(btrc_items[i]);

      switch (btrc_item->item_type) {

        case BTRC_ITEM_MEDIA:

          osi_free(btrc_item->media.p_attrs);

          break;

        case BTRC_ITEM_PLAYER:

        case BTRC_ITEM_FOLDER:

          /*Nothing to free*/

          break;

        default:

          BTIF_TRACE_WARNING("%s free unspecified type", __func__);

      }

    }



    osi_free(btrc_items);

  } else {

    BTIF_TRACE_ERROR("%s: Error %d", __func__, p_rsp->status);
@@ -3958,11 +3977,6 @@ void get_folder_item_type_media(const tAVRC_ITEM* avrc_item, 
  memcpy(btrc_item_media->name, avrc_item_media->name.p_str,

         sizeof(uint8_t) * (avrc_item_media->name.str_len));



  /* Copy the parameters */

  btrc_item_media->num_attrs = avrc_item_media->attr_count;

  btrc_item_media->p_attrs = (btrc_element_attr_val_t*)osi_malloc(

      btrc_item_media->num_attrs * sizeof(btrc_element_attr_val_t));



  /* Extract each attribute */

  for (int i = 0; i < avrc_item_media->attr_count; i++) {

    btrc_element_attr_val_t* btrc_attr_pair = &(btrc_item_media->p_attrs[i]);
@@ -4083,6 +4097,8 @@ void get_folder_item_type_player(const tAVRC_ITEM* avrc_item, 
  btrc_item_player->major_type = avrc_item_player->major_type;

  /* Sub type */

  btrc_item_player->sub_type = avrc_item_player->sub_type;

  /* Play status */

  btrc_item_player->play_status = avrc_item_player->play_status;

  /* Features */

  memcpy(btrc_item_player->features, avrc_item_player->features,

         BTRC_FEATURE_BIT_MASK_SIZE);