diff options
| author | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2014-02-06 14:00:56 +0200 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2014-02-06 14:00:56 +0200 |
| commit | 8da3f380860e104e371a9e20bdb2b1fe7746abf6 (patch) | |
| tree | 4f64f2e02b6d6d03b74a3ef55c627616a5c81157 /android/a2dp.c | |
| parent | cbce18be2232b2725d08caaff90333f966150301 (diff) | |
| download | bluez-8da3f380860e104e371a9e20bdb2b1fe7746abf6.tar.gz | |
android/A2DP: Fix invalid read
Invalid read of size 8
at 0x30EE465A78: g_slice_free_chain_with_offset (in /usr/lib64/libglib-2.0.so.0.3800.2)
by 0x418209: bt_a2dp_unregister (a2dp.c:1576)
by 0x4039E6: main (main.c:347)
Address 0x4f2d248 is 8 bytes inside a block of size 16 free'd
at 0x4A07577: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
by 0x30EE44EF7E: g_free (in /usr/lib64/libglib-2.0.so.0.3800.2)
by 0x30EE4655CA: g_slice_free1 (in /usr/lib64/libglib-2.0.so.0.3800.2)
by 0x30EE465F0C: g_slist_remove (in /usr/lib64/libglib-2.0.so.0.3800.2)
by 0x41645F: a2dp_device_free (a2dp.c:174)
by 0x30EE466477: g_slist_foreach (in /usr/lib64/libglib-2.0.so.0.3800.2)
by 0x30EE46649A: g_slist_free_full (in /usr/lib64/libglib-2.0.so.0.3800.2)
by 0x418209: bt_a2dp_unregister (a2dp.c:1576)
by 0x4039E6: main (main.c:347)
Diffstat (limited to 'android/a2dp.c')
| -rw-r--r-- | android/a2dp.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/android/a2dp.c b/android/a2dp.c index 731fa1623..8cff5357b 100644 --- a/android/a2dp.c +++ b/android/a2dp.c @@ -171,10 +171,15 @@ static void a2dp_device_free(void *data) setup_remove_all_by_dev(dev); - devices = g_slist_remove(devices, dev); g_free(dev); } +static void a2dp_device_remove(struct a2dp_device *dev) +{ + devices = g_slist_remove(devices, dev); + a2dp_device_free(dev); +} + static struct a2dp_device *a2dp_device_new(const bdaddr_t *dst) { struct a2dp_device *dev; @@ -229,7 +234,7 @@ static void bt_a2dp_notify_state(struct a2dp_device *dev, uint8_t state) bt_avrcp_disconnect(&dev->dst); - a2dp_device_free(dev); + a2dp_device_remove(dev); } static void bt_audio_notify_state(struct a2dp_setup *setup, uint8_t state) @@ -579,7 +584,7 @@ static void bt_a2dp_connect(const void *buf, uint16_t len) dev = a2dp_device_new(&dst); if (!a2dp_device_connect(dev, signaling_connect_cb)) { - a2dp_device_free(dev); + a2dp_device_remove(dev); status = HAL_STATUS_FAILED; goto failed; } |