Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 532ee63a authored by Andre Eisenbach's avatar Andre Eisenbach Committed by Matthew Xie
Browse files

LE: Memory leak when caching GATT service change 

When a GATT connection is disconnected, a bonded device will be added
into service change pending list. But if the device is already in the
list, a duplicate record will be added and one buffer is lost.

This change ensures that devices are only added if they are not already
in the list.

Change-Id: Ied6872b145ed28bde8044444cb6c9cbee525943d
parent 059700ed

system/stack/gatt/gatt_main.c

+9 −6
Original line number Diff line number Diff line
@@ -736,9 +736,10 @@ void gatt_l2cif_disconnect_ind_cback(UINT16 lcid, BOOLEAN ack_needed) 
            L2CA_DisconnectRsp(lcid);

        }



        if (gatt_is_bda_in_the_srv_chg_clt_list(p_tcb->peer_bda) == NULL)

        {

            if (btm_sec_is_a_bonded_dev(p_tcb->peer_bda) &&

                btm_sec_is_le_capable_dev(p_tcb->peer_bda))

        {

                gatt_add_a_bonded_dev_for_srv_chg(p_tcb->peer_bda);

        }
@@ -768,10 +769,12 @@ void gatt_l2cif_disconnect_cfm_cback(UINT16 lcid, UINT16 result) 


    /* look up clcb for this channel */

    if ((p_tcb = gatt_find_tcb_by_cid(lcid)) != NULL)

    {

        /* If the device is not in the service changed client list, add it... */

        if (gatt_is_bda_in_the_srv_chg_clt_list(p_tcb->peer_bda) == NULL)

        {

            if (btm_sec_is_a_bonded_dev(p_tcb->peer_bda) &&

                btm_sec_is_le_capable_dev(p_tcb->peer_bda))

        {

                gatt_add_a_bonded_dev_for_srv_chg(p_tcb->peer_bda);

        }