Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bc9f9417 authored by Greg Kaiser's avatar Greg Kaiser
Browse files

bta_jv_act: Avoid writing through NULL/freed pointer 

Before writing to 't->init_called', we know that 't' might be
NULL (there's an explicit check), so we add another check here
to assure it's not NULL.  Furthermore, we're possibly freeing
't' prior to writing to 't->init_called'.  So we set 't' NULL
in that case, so our new NULL check will let us avoid corrupting
memory we no longer own.

Test: TreeHugger
Change-Id: Iaa246d5190f5f99610dace24707e74a846df3cf3
parent 827f9855

system/bta/jv/bta_jv_act.cc

+7 −3
Original line number Diff line number Diff line
@@ -2165,14 +2165,18 @@ void bta_jv_l2cap_connect_le(uint16_t remote_chan, 
  // it could have been deleted/moved from under us, so re-find it */

  t = fcclient_find_by_id(id);

  if (t) {

    if (evt.l2c_cl_init.status == BTA_JV_SUCCESS)

    if (evt.l2c_cl_init.status == BTA_JV_SUCCESS) {

      call_init_f = !t->init_called;

    else

    } else {

      fcclient_free(t);

      t = NULL;

    }

  }

  if (call_init_f) p_cback(BTA_JV_L2CAP_CL_INIT_EVT, &evt, l2cap_socket_id);

  if (t) {

    t->init_called = true;

  }

}



/* stops an LE L2CAP server */

void bta_jv_l2cap_stop_server_le(uint16_t local_chan) {