diff options
| author | Lucas De Marchi <lucas.de.marchi@gmail.com> | 2012-10-04 14:07:19 -0300 |
|---|---|---|
| committer | Johan Hedberg <johan.hedberg@intel.com> | 2012-10-04 21:21:12 +0300 |
| commit | be8c5be809875ba449a10ca29f5244f0231f6b63 (patch) | |
| tree | a7830d93efeb146ae6b2951763e1282c4d89fa5b | |
| parent | fc67e0ca0658239b3778f6cbbd5cc778a1544714 (diff) | |
| download | bluez-be8c5be809875ba449a10ca29f5244f0231f6b63.tar.gz | |
core: Fix walking the list while removing elements
If we are walking a GSList and remove the element we are pointing to,
the next iteration g_slist_next() will access previously freed
memory.
| -rw-r--r-- | src/device.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/src/device.c b/src/device.c index c659164d6..0339bcf79 100644 --- a/src/device.c +++ b/src/device.c @@ -1469,7 +1469,7 @@ static void device_remove_profiles(struct btd_device *device, GSList *uuids) char srcaddr[18], dstaddr[18]; bdaddr_t src; sdp_list_t *records; - GSList *l; + GSList *l, *next; adapter_get_address(adapter, &src); ba2str(&src, srcaddr); @@ -1498,10 +1498,11 @@ static void device_remove_profiles(struct btd_device *device, GSList *uuids) if (records) sdp_list_free(records, (sdp_free_func_t) sdp_record_free); - for (l = device->profiles; l != NULL; l = g_slist_next(l)) { + for (l = device->profiles; l != NULL; l = next) { struct btd_profile *profile = l->data; GSList *probe_uuids; + next = l->next; probe_uuids = device_match_profile(device, profile, device->uuids); if (probe_uuids != NULL) { |