Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit dd8aa226 authored by Jakub Pawlowski's avatar Jakub Pawlowski
Browse files

Fix crashes in btm_consolidate_dev 

It is not safe to do list_next after list_remove.

Test: sl4a BleStressTest:test_le_pairing
Bug: 31442085
Change-Id: Ib4cb02154684b39ebc652d20559e1b07eee2c357
Merged-In: Ib4cb02154684b39ebc652d20559e1b07eee2c357
(cherry picked from commit 8ec8b8c3)
parent b01b5a8f

system/stack/btm/btm_dev.cc

+5 −2
Original line number Diff line number Diff line
@@ -384,11 +384,14 @@ void btm_consolidate_dev(tBTM_SEC_DEV_REC* p_target_rec) { 
  BTM_TRACE_DEBUG("%s", __func__);



  list_node_t* end = list_end(btm_cb.sec_dev_rec);

  for (list_node_t* node = list_begin(btm_cb.sec_dev_rec); node != end;

       node = list_next(node)) {

  list_node_t* node = list_begin(btm_cb.sec_dev_rec);

  while (node != end) {

    tBTM_SEC_DEV_REC* p_dev_rec =

        static_cast<tBTM_SEC_DEV_REC*>(list_node(node));



    // we do list_remove in some cases, must grab next before removing

    node = list_next(node);



    if (p_target_rec == p_dev_rec) continue;



    if (p_dev_rec->bd_addr == p_target_rec->bd_addr) {