Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e8c8c065 authored by Pavlin Radoslavov's avatar Pavlin Radoslavov Committed by android-build-merger
Browse files

Free p_pending_data from tBNEP_CONN to avoid potential memory leaks am: b618a14f 

am: 7b15b427

Change-Id: I8378625c5a70086829b18ca7ac9cd8dc3e145f7f
parents 99bb31a8 7b15b427

system/stack/bnep/bnep_main.cc

+1 −0
Original line number Diff line number Diff line
@@ -525,6 +525,7 @@ static void bnep_data_ind(uint16_t l2cap_cid, BT_HDR* p_buf) { 
      if (ctrl_type == BNEP_SETUP_CONNECTION_REQUEST_MSG &&

          p_bcb->con_state != BNEP_STATE_CONNECTED && extension_present && p &&

          rem_len) {

        osi_free(p_bcb->p_pending_data);

        p_bcb->p_pending_data = (BT_HDR*)osi_malloc(rem_len + sizeof(BT_HDR));

        memcpy((uint8_t*)(p_bcb->p_pending_data + 1), p, rem_len);

        p_bcb->p_pending_data->len = rem_len;

system/stack/bnep/bnep_utils.cc

+1 −1
Original line number Diff line number Diff line
@@ -143,7 +143,7 @@ void bnepu_release_bcb(tBNEP_CONN* p_bcb) { 


  /* Drop any response pointer we may be holding */

  p_bcb->con_state = BNEP_STATE_IDLE;

  p_bcb->p_pending_data = NULL;

  osi_free_and_reset((void**)&p_bcb->p_pending_data);



  /* Free transmit queue */

  while (!fixed_queue_is_empty(p_bcb->xmit_q)) {