Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e46b7dfb authored by Myles Watson's avatar Myles Watson Committed by android-build-merger
Browse files

HCI: Fix use after free in hci_transmit am: 81f39795 am: 84be1d9c 

am: bdd59050

Change-Id: I0bd7f7513ba991956959df4cf35a1e39b1467f83
parents a43c96b0 bdd59050

system/hci/src/hci_layer.cc

+8 −2
Original line number Diff line number Diff line
@@ -427,12 +427,18 @@ static void event_packet_ready(void* pkt) { 
static void transmit_fragment(BT_HDR* packet, bool send_transmit_finished) {

  btsnoop->capture(packet, false);



  // HCI command packets are freed on a different thread when the matching

  // event is received. Check packet->event before sending to avoid a race.

  bool free_after_transmit =

      (packet->event & MSG_EVT_MASK) != MSG_STACK_TO_HC_HCI_CMD &&

      send_transmit_finished;



  hci_transmit(packet);



  uint16_t event = packet->event & MSG_EVT_MASK;

  if (event != MSG_STACK_TO_HC_HCI_CMD && send_transmit_finished)

  if (free_after_transmit) {

    buffer_allocator->free(packet);

  }

}



static void fragmenter_transmit_finished(BT_HDR* packet,

                                         bool all_fragments_sent) {