Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c4a34b7f authored by Joseph Pirozzo's avatar Joseph Pirozzo
Browse files

Fix memory leak for BTRC_ITEM_MEDIA. 

Memory is allocated for each media item received from a remote phone for
AVRCP media browsing.  Although the media item itself was freed, the
memory for each attribute was not freed.  Move the allocation up to
the parent function such that it can be allocated and freed in the same
location.

Bug: 78222934
Test: dumpsys meminfo com.android.bluetooth
Change-Id: I217830441949642cd6ef0f96ac5fde9251452095
parent d3af716a

system/btif/src/btif_rc.cc

+22 −6
Original line number Diff line number Diff line
@@ -3894,6 +3894,10 @@ static void handle_get_folder_items_response(tBTA_AV_META_MSG* pmeta_msg, 
      switch (avrc_item->item_type) {

        case AVRC_ITEM_MEDIA:

          BTIF_TRACE_DEBUG("%s setting type to %d", __func__, BTRC_ITEM_MEDIA);

          /* Allocate Space for Attributes */

          btrc_item->media.num_attrs = avrc_item->u.media.attr_count;

          btrc_item->media.p_attrs = (btrc_element_attr_val_t*)osi_malloc(

              btrc_item->media.num_attrs * sizeof(btrc_element_attr_val_t));

          get_folder_item_type_media(avrc_item, btrc_item);

          break;
@@ -3919,7 +3923,22 @@ static void handle_get_folder_items_response(tBTA_AV_META_MSG* pmeta_msg, 
              (const btrc_folder_items_t*)btrc_items, item_count);

    BTIF_TRACE_DEBUG("%s HAL CBACK get_folder_items_cb finished", __func__);



    /* Release the memory block for items since we OWN the object */

    /* Release the memory block for items and attributes allocated here */

    for (uint8_t i = 0; i < item_count; i++) {

      btrc_folder_items_t* btrc_item = &(btrc_items[i]);

      switch (btrc_item->item_type) {

        case BTRC_ITEM_MEDIA:

          osi_free(btrc_item->media.p_attrs);

          break;

        case BTRC_ITEM_PLAYER:

        case BTRC_ITEM_FOLDER:

          /*Nothing to free*/

          break;

        default:

          BTIF_TRACE_WARNING("%s free unspecified type", __func__);

      }

    }



    osi_free(btrc_items);

  } else {

    BTIF_TRACE_ERROR("%s: Error %d", __func__, p_rsp->status);
@@ -3967,11 +3986,6 @@ void get_folder_item_type_media(const tAVRC_ITEM* avrc_item, 
  memcpy(btrc_item_media->name, avrc_item_media->name.p_str,

         sizeof(uint8_t) * (avrc_item_media->name.str_len));



  /* Copy the parameters */

  btrc_item_media->num_attrs = avrc_item_media->attr_count;

  btrc_item_media->p_attrs = (btrc_element_attr_val_t*)osi_malloc(

      btrc_item_media->num_attrs * sizeof(btrc_element_attr_val_t));



  /* Extract each attribute */

  for (int i = 0; i < avrc_item_media->attr_count; i++) {

    btrc_element_attr_val_t* btrc_attr_pair = &(btrc_item_media->p_attrs[i]);
@@ -4092,6 +4106,8 @@ void get_folder_item_type_player(const tAVRC_ITEM* avrc_item, 
  btrc_item_player->major_type = avrc_item_player->major_type;

  /* Sub type */

  btrc_item_player->sub_type = avrc_item_player->sub_type;

  /* Play status */

  btrc_item_player->play_status = avrc_item_player->play_status;

  /* Features */

  memcpy(btrc_item_player->features, avrc_item_player->features,

         BTRC_FEATURE_BIT_MASK_SIZE);