Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cde75cf5 authored by Brian Delwiche's avatar Brian Delwiche
Browse files

Defer free in bta_hh_act.cc 

Bug: 228837201
Test: BT unit tests, manual testing
Tag: #security
Ignore-AOSP-First: Security
Change-Id: I31842c488909798574a161ebfa009988f330904f
parent 96f108e8

system/bta/hh/bta_hh_act.cc

+5 −1
Original line number Diff line number Diff line
@@ -706,6 +706,7 @@ void bta_hh_ctrl_dat_act(tBTA_HH_DEV_CB* p_cb, const tBTA_HH_DATA* p_data) { 
  BT_HDR* pdata = p_data->hid_cback.p_data;

  uint8_t* data = (uint8_t*)(pdata + 1) + pdata->offset;

  tBTA_HH_HSDATA hs_data;

  bool do_free = true;



  APPL_TRACE_DEBUG("Ctrl DATA received w4: event[%s]",

                   bta_hh_get_w4_event(p_cb->w4_evt));
@@ -726,6 +727,7 @@ void bta_hh_ctrl_dat_act(tBTA_HH_DEV_CB* p_cb, const tBTA_HH_DATA* p_data) { 
      hs_data.rsp_data.p_rpt_data = pdata;

      bta_hh_co_get_rpt_rsp(hs_data.handle, hs_data.status, pdata->data,

                            pdata->len);

      do_free = false;

      break;

    case BTA_HH_GET_PROTO_EVT:

      /* match up BTE/BTA report/boot mode def*/
@@ -757,8 +759,10 @@ void bta_hh_ctrl_dat_act(tBTA_HH_DEV_CB* p_cb, const tBTA_HH_DATA* p_data) { 
  (*bta_hh_cb.p_cback)(p_cb->w4_evt, (tBTA_HH*)&hs_data);



  p_cb->w4_evt = 0;

  if (do_free) {

    osi_free_and_reset((void**)&pdata);

  }

}



/*******************************************************************************

 *

system/btif/src/btif_hh.cc

+4 −0
Original line number Diff line number Diff line
@@ -893,6 +893,10 @@ static void btif_hh_upstreams_evt(uint16_t event, char* p_param) { 
        BTIF_TRACE_WARNING("Error: cannot find device with handle %d",

                           p_data->hs_data.handle);

      }

      if (hdr) {

        osi_free(hdr);

        p_data->hs_data.rsp_data.p_rpt_data = NULL;

      }

      break;

    }