Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit da2a0234 authored by Andre Eisenbach's avatar Andre Eisenbach
Browse files

Avoid null-pointer dereference in l2c_release_lcb() 

Change-Id: Id46d678e45797c4d3d3c8e024f42cfd06b1d2da2
parent 9d2913a6

system/stack/l2cap/l2c_utils.c

+10 −6
Original line number Diff line number Diff line
@@ -214,7 +214,10 @@ void l2cu_release_lcb (tL2C_LCB *p_lcb) 
#else

        btm_acl_removed (p_lcb->remote_bd_addr, BT_TRANSPORT_BR_EDR);

#endif



    /* Release any held buffers */

    if (p_lcb->link_xmit_data_q)

    {

        while (!list_is_empty(p_lcb->link_xmit_data_q)) {

            BT_HDR *p_buf = list_front(p_lcb->link_xmit_data_q);

            list_remove(p_lcb->link_xmit_data_q, p_buf);
@@ -222,6 +225,7 @@ void l2cu_release_lcb (tL2C_LCB *p_lcb) 
        }

        list_free(p_lcb->link_xmit_data_q);

        p_lcb->link_xmit_data_q = NULL;

    }



#if (L2CAP_UCD_INCLUDED == TRUE)

    /* clean up any security pending UCD */