Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b618a14f authored by Pavlin Radoslavov's avatar Pavlin Radoslavov
Browse files

Free p_pending_data from tBNEP_CONN to avoid potential memory leaks 

Bug: 63146105
Test: External script
Change-Id: I1281779ccf38d1d2dfb1a6dc0e45c0e533cabbca
Merged-In: I1281779ccf38d1d2dfb1a6dc0e45c0e533cabbca
(cherry picked from commit 4982eb5df30cbcbee5c8b8807be95fdc6dfa63c5)
parent 50cbac4f

system/stack/bnep/bnep_main.cc

+1 −0
Original line number Diff line number Diff line
@@ -525,6 +525,7 @@ static void bnep_data_ind(uint16_t l2cap_cid, BT_HDR* p_buf) { 
      if (ctrl_type == BNEP_SETUP_CONNECTION_REQUEST_MSG &&

          p_bcb->con_state != BNEP_STATE_CONNECTED && extension_present && p &&

          rem_len) {

        osi_free(p_bcb->p_pending_data);

        p_bcb->p_pending_data = (BT_HDR*)osi_malloc(rem_len + sizeof(BT_HDR));

        memcpy((uint8_t*)(p_bcb->p_pending_data + 1), p, rem_len);

        p_bcb->p_pending_data->len = rem_len;

system/stack/bnep/bnep_utils.cc

+1 −1
Original line number Diff line number Diff line
@@ -144,7 +144,7 @@ void bnepu_release_bcb(tBNEP_CONN* p_bcb) { 


  /* Drop any response pointer we may be holding */

  p_bcb->con_state = BNEP_STATE_IDLE;

  p_bcb->p_pending_data = NULL;

  osi_free_and_reset((void**)&p_bcb->p_pending_data);



  /* Free transmit queue */

  while (!fixed_queue_is_empty(p_bcb->xmit_q)) {