korg/bluez
0
0
Fork 0
mirror of https://git.kernel.org/pub/scm/bluetooth/bluez.git synced 2024-11-29 15:14:31 +08:00
Code Issues Packages Projects Releases Wiki Activity

android/A2DP: Fix invalid read

Browse Source 
Invalid read of size 8
   at 0x30EE465A78: g_slice_free_chain_with_offset (in /usr/lib64/libglib-2.0.so.0.3800.2)
   by 0x418209: bt_a2dp_unregister (a2dp.c:1576)
   by 0x4039E6: main (main.c:347)
 Address 0x4f2d248 is 8 bytes inside a block of size 16 free'd
   at 0x4A07577: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
   by 0x30EE44EF7E: g_free (in /usr/lib64/libglib-2.0.so.0.3800.2)
   by 0x30EE4655CA: g_slice_free1 (in /usr/lib64/libglib-2.0.so.0.3800.2)
   by 0x30EE465F0C: g_slist_remove (in /usr/lib64/libglib-2.0.so.0.3800.2)
   by 0x41645F: a2dp_device_free (a2dp.c:174)
   by 0x30EE466477: g_slist_foreach (in /usr/lib64/libglib-2.0.so.0.3800.2)
   by 0x30EE46649A: g_slist_free_full (in /usr/lib64/libglib-2.0.so.0.3800.2)
   by 0x418209: bt_a2dp_unregister (a2dp.c:1576)
   by 0x4039E6: main (main.c:347)
This commit is contained in:
Luiz Augusto von Dentz 2014-02-06 14:00:56 +02:00
parent cbce18be22
commit 8da3f38086
1 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
android/a2dp.c
View File

@ -171,10 +171,15 @@ static void a2dp_device_free(void *data)
setup_remove_all_by_dev(dev);
devices = g_slist_remove(devices, dev);
g_free(dev);
}
static void a2dp_device_remove(struct a2dp_device *dev)
{
devices = g_slist_remove(devices, dev);
a2dp_device_free(dev);
}
static struct a2dp_device *a2dp_device_new(const bdaddr_t *dst)
{
struct a2dp_device *dev;
@ -229,7 +234,7 @@ static void bt_a2dp_notify_state(struct a2dp_device *dev, uint8_t state)
bt_avrcp_disconnect(&dev->dst);
a2dp_device_free(dev);
a2dp_device_remove(dev);
}
static void bt_audio_notify_state(struct a2dp_setup *setup, uint8_t state)
@ -579,7 +584,7 @@ static void bt_a2dp_connect(const void *buf, uint16_t len)
dev = a2dp_device_new(&dst);
if (!a2dp_device_connect(dev, signaling_connect_cb)) {
a2dp_device_free(dev);
a2dp_device_remove(dev);
status = HAL_STATUS_FAILED;
goto failed;
}