Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9e8bb6e1 authored by Manu Viswanadhan's avatar Manu Viswanadhan Committed by Ajay Panicker
Browse files

Initializing the SDP event message pointer before sending 

Use case: Crash while copying SDP results in case of SDP
ServiceSearchAttributeRequest failure

Steps : Repeated connection-disconnection with multiple devices

Failure: Crash while copying SDP results

Root cause: In case of SDP_ServiceSearchAttributeRequest failure,
garbage value sent for discovery result structure due to improper
initialization

Fix: Initialize the discovery result structure to zero before
sending

Test: code compilation.

Change-Id: I46d92d6262bae3b5def5401270465a3a06468c1a
parent c021fcfd

system/bta/dm/bta_dm_act.cc

+2 −0
Original line number Original line Diff line number Diff line
@@ -2013,6 +2013,8 @@ static void bta_dm_find_services(BD_ADDR bd_addr) { 
  /* no more services to be discovered */

  /* no more services to be discovered */

  if (bta_dm_search_cb.service_index >= BTA_MAX_SERVICE_ID) {

  if (bta_dm_search_cb.service_index >= BTA_MAX_SERVICE_ID) {

    tBTA_DM_MSG* p_msg = (tBTA_DM_MSG*)osi_malloc(sizeof(tBTA_DM_MSG));

    tBTA_DM_MSG* p_msg = (tBTA_DM_MSG*)osi_malloc(sizeof(tBTA_DM_MSG));

    /* initialize the data structure - includes p_raw_data and raw_data_size */

    memset(&(p_msg->disc_result.result), 0, sizeof(tBTA_DM_DISC_RES));

    p_msg->hdr.event = BTA_DM_DISCOVERY_RESULT_EVT;

    p_msg->hdr.event = BTA_DM_DISCOVERY_RESULT_EVT;

    p_msg->disc_result.result.disc_res.services =

    p_msg->disc_result.result.disc_res.services =

        bta_dm_search_cb.services_found;

        bta_dm_search_cb.services_found;