Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit da3aaccb authored by Srinu Jella's avatar Srinu Jella Committed by Andre Eisenbach
Browse files

Add null checks for L2CAP socket callback 

Use Case: Bluetooth process crashed while sending the file
to remote device.

Steps: Send a file over L2CAP (OBEX over L2CAP) to remote device

Failure: BT process will crash and restarted automatically

Root Cause: L2CAP socket callback reset to null on error
condition, and when other function try to dereference it, this
leads to BT crash.

Fix: Added null checks for L2CAP socket callback

Change-Id: I2e4f20278fcc8a09bd4dbd507a6c4147e0de93c1
parent 32175cb8

system/bta/jv/bta_jv_act.c

+6 −3
Original line number Diff line number Diff line
@@ -1115,6 +1115,7 @@ void bta_jv_l2cap_connect(tBTA_JV_MSG *p_data) 
    }



    evt_data.handle = handle;

    if(cc->p_cback)

        cc->p_cback(BTA_JV_L2CAP_CL_INIT_EVT, (tBTA_JV *)&evt_data, cc->user_data);

}
@@ -1280,6 +1281,7 @@ void bta_jv_l2cap_start_server(tBTA_JV_MSG *p_data) 
        p_cb->psm = ls->local_psm;

    }



    if(ls->p_cback)

        ls->p_cback(BTA_JV_L2CAP_START_EVT, (tBTA_JV *)&evt_data, ls->user_data);

}
@@ -1309,6 +1311,7 @@ void bta_jv_l2cap_stop_server(tBTA_JV_MSG *p_data) 
            evt_data.handle = p_cb->handle;

            evt_data.status = bta_jv_free_l2c_cb(p_cb);

            evt_data.async = false;

            if(p_cback)

                p_cback(BTA_JV_L2CAP_CLOSE_EVT, (tBTA_JV *)&evt_data, user_data);

            break;

        }