Avoid double memory free and crash during LE discovery or disconnect (78d2c647) · Commits · e / os / android_packages_modules_Bluetooth

system/bta/gatt/bta_gattc_act.c

+4 −2

Original line number	Diff line number	Diff line
		@@ -1064,8 +1064,10 @@ void bta_gattc_disc_cmpl(tBTA_GATTC_CLCB p_clcb, tBTA_GATTC_DATA p_data)
		else if (p_q_cmd != NULL)
		{
		p_clcb->p_q_cmd = NULL;

		/* execute pending operation of link block still present */
		if (l2cu_find_lcb_by_bd_addr(p_clcb->p_srcb->server_bda, BT_TRANSPORT_LE) != NULL) {
		bta_gattc_sm_execute(p_clcb, p_q_cmd->hdr.event, p_q_cmd);
		}
		/* if the command executed requeued the cmd, we don't
		* want to free the underlying buffer that's being
		* referenced by p_clcb->p_q_cmd

+8 −10

Original line number	Diff line number	Diff line
		@@ -443,14 +443,12 @@ BOOLEAN bta_gattc_enqueue(tBTA_GATTC_CLCB p_clcb, tBTA_GATTC_DATA p_data)
		if (p_clcb->p_q_cmd == NULL)
		{
		p_clcb->p_q_cmd = p_data;
		return TRUE;
		}
		else
		{
		APPL_TRACE_ERROR("already has a pending command!!");
		/* skip the callback now. ----- need to send callback ? */
		}
		return (p_clcb->p_q_cmd != NULL) ? TRUE : FALSE;

		APPL_TRACE_ERROR ("%s: already has a pending command!!", __func__);
		/* skip the callback now. ----- need to send callback ? */
		return FALSE;
		}

		/*******************************************************************************