Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4668afcd authored by Omair Kamil's avatar Omair Kamil
Browse files

Fixes null pointer dereferences introduced when moving scanning callbacks into their own object. 

Bug: 331759784
Flag: EXEMPT - crash fix that isn't flag guardable
Test: atest BluetoothInstrumentationTests, atest BumbleBluetoothTests
Change-Id: Icf9b95499fb3a35ce3f9ba5c1804933cbfa2a929
parent 0551cac0

android/app/jni/com_android_bluetooth_gatt.cpp

+2 −2
Original line number Diff line number Diff line
@@ -457,7 +457,7 @@ void btgattc_track_adv_event_cb(btgatt_track_adv_info_t* p_adv_track_info) { 
  ScopedLocalRef<jobject> trackadv_obj(

      sCallbackEnv.get(),

      sCallbackEnv->CallObjectMethod(

          mCallbacksObj, method_createOnTrackAdvFoundLostObject,

          mScanCallbacksObj, method_createOnTrackAdvFoundLostObject,

          p_adv_track_info->client_if, p_adv_track_info->adv_pkt_len,

          jb_adv_pkt.get(), p_adv_track_info->scan_rsp_len, jb_scan_rsp.get(),

          p_adv_track_info->filt_index, p_adv_track_info->advertiser_state,
@@ -1061,7 +1061,7 @@ class JniScanningCallbacks : ScanningCallbacks { 
    ScopedLocalRef<jobject> trackadv_obj(

        sCallbackEnv.get(),

        sCallbackEnv->CallObjectMethod(

            mCallbacksObj, method_createOnTrackAdvFoundLostObject,

            mScanCallbacksObj, method_createOnTrackAdvFoundLostObject,

            track_info.scanner_id, track_info.adv_packet_len, jb_adv_pkt.get(),

            track_info.scan_response_len, jb_scan_rsp.get(),

            track_info.filter_index, track_info.advertiser_state,