[automerger] Fix potential usage of freed memory in btif_hl_proc_sdp_query_cfm... (a892a042) · Commits · e / os / android_packages_modules_Bluetooth

system/bta/hl/bta_hl_main.c

+1 −5

Original line number	Diff line number	Diff line
		@@ -1564,15 +1564,14 @@ static void bta_hl_sdp_query_results(tBTA_HL_CB p_cb, tBTA_HL_DATA p_data)
		tBTA_HL_MCL_CB *p_mcb = BTA_HL_GET_MCL_CB_PTR( app_idx, mcl_idx);
		tBTA_HL_SDP *p_sdp=NULL;
		UINT16 event;
		BOOLEAN release_sdp_buf=FALSE;
		UNUSED(p_cb);

		event = p_data->hdr.event;

		if (event == BTA_HL_SDP_QUERY_OK_EVT) {
		// this is freed in btif_hl_proc_sdp_query_cfm
		p_sdp = (tBTA_HL_SDP *)osi_malloc(sizeof(tBTA_HL_SDP));
		memcpy(p_sdp, &p_mcb->sdp, sizeof(tBTA_HL_SDP));
		release_sdp_buf = TRUE;
		} else {
		status = BTA_HL_STATUS_SDP_FAIL;
		}
		@@ -1589,9 +1588,6 @@ static void bta_hl_sdp_query_results(tBTA_HL_CB p_cb, tBTA_HL_DATA p_data)
		p_mcb->bd_addr,p_sdp,status);
		p_acb->p_cback(BTA_HL_SDP_QUERY_CFM_EVT,(tBTA_HL *) &evt_data );

		if (release_sdp_buf)
		osi_free_and_reset((void **)&p_sdp);

		if (p_data->cch_sdp.release_mcl_cb) {
		memset(p_mcb, 0, sizeof(tBTA_HL_MCL_CB));
		} else {

+4 −0

Original line number	Diff line number	Diff line
		@@ -2333,6 +2333,10 @@ static BOOLEAN btif_hl_proc_sdp_query_cfm(tBTA_HL *p_data){
		}
		}
		}

		// this was allocated in bta_hl_sdp_query_results
		osi_free_and_reset((void**)&p_data->sdp_query_cfm.p_sdp);

		return status;
		}