korg/bluez
0
0
Fork 0
mirror of https://git.kernel.org/pub/scm/bluetooth/bluez.git synced 2025-01-10 13:33:33 +08:00
Code Issues Packages Projects Releases Wiki Activity

A2DP: Fix regression introduce by 99c6f52218

Browse Source 
Commit 99c6f52218 checks if there is a
pending resume and in case OPEN fails it abort it as well, but it can
cause a crash if resume was not requested and the setup is freed by
finalize_config:

Invalid read of size 4
   at 0x4214AD: open_cfm (a2dp.c:730)
   by 0x424D07: handle_transport_connect (avdtp.c:878)
   by 0x4288F2: avdtp_connect_cb (avdtp.c:2419)
   by 0x4458B8: connect_cb (btio.c:230)
   by 0x4E79D12: g_main_context_dispatch (gmain.c:2539)
   by 0x4E7A05F: g_main_context_iterate.isra.23 (gmain.c:3146)
   by 0x4E7A459: g_main_loop_run (gmain.c:3340)
   by 0x44B0AC: main (main.c:583)
 Address 0x62c8564 is 68 bytes inside a block of size 88 free'd
   at 0x4C2A82E: free (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
   by 0x420094: setup_free (a2dp.c:156)
   by 0x420101: setup_unref (a2dp.c:168)
   by 0x4201CF: setup_cb_free (a2dp.c:191)
   by 0x4203DC: finalize_config (a2dp.c:234)
   by 0x4214A8: open_cfm (a2dp.c:728)
   by 0x424D07: handle_transport_connect (avdtp.c:878)
   by 0x4288F2: avdtp_connect_cb (avdtp.c:2419)
   by 0x4458B8: connect_cb (btio.c:230)
   by 0x4E79D12: g_main_context_dispatch (gmain.c:2539)
   by 0x4E7A05F: g_main_context_iterate.isra.23 (gmain.c:3146)
   by 0x4E7A459: g_main_loop_run (gmain.c:3340)
This commit is contained in:
Luiz Augusto von Dentz 2013-05-16 14:17:31 +03:00
parent 7be98f21d6
commit 086b653b66
1 changed files with 2 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
profiles/audio/a2dp.c
View File

@ -723,16 +723,12 @@ static void open_cfm(struct avdtp *session, struct avdtp_local_sep *sep,
if (err) {
setup->stream = NULL;
setup->err = err;
if (setup->start)
finalize_resume(setup);
}
finalize_config(setup);
if (!setup->start || !err)
return;
setup->start = FALSE;
finalize_resume(setup);
return;
}