diff options
| author | Szymon Janc <szymon.janc@tieto.com> | 2014-09-26 15:14:02 +0200 |
|---|---|---|
| committer | Szymon Janc <szymon.janc@tieto.com> | 2014-09-26 15:38:45 +0200 |
| commit | 7a964f0bfa0c11cf8a838e89879f0b4ffb00b531 (patch) | |
| tree | de25817eff76a35f7665a5cb8a397e27938fd4ec /android/avdtp.c | |
| parent | 741c656a241f683ac900c40c9bd3b46049601cb9 (diff) | |
| download | bluez-7a964f0bfa0c11cf8a838e89879f0b4ffb00b531.tar.gz | |
android/avdtp: Fix crash on disconnect
Last reference to session may be dropped while calling connection_lost
so move watch ID clean before that.
external/bluetooth/bluez/android/avdtp.c:session_cb()
external/bluetooth/bluez/android/avdtp.c:avdtp_parse_resp() CLOSE
request succeeded
external/bluetooth/bluez/android/avdtp.c:avdtp_sep_set_state() stream
state changed: OPEN -> CLOSING
external/bluetooth/bluez/android/a2dp.c:sep_close_cfm()
external/bluetooth/bluez/android/avdtp.c:avdtp_sep_set_state() stream
state changed: CLOSING -> IDLE
external/bluetooth/bluez/android/avdtp.c:session_cb()
external/bluetooth/bluez/android/avdtp.c:connection_lost()
Disconnected: I/O error (5)
external/bluetooth/bluez/android/avdtp.c:avdtp_ref() 0x4a27fc8: ref=2
external/bluetooth/bluez/android/a2dp.c:bt_a2dp_notify_state() device
00:1E:DE:21:85:6A state 0
external/bluetooth/bluez/android/avrcp.c:bt_avrcp_disconnect()
external/bluetooth/bluez/android/avctp.c:avctp_shutdown() AVCTP:
closing uinput
external/bluetooth/bluez/android/avrcp.c:disconnect_cb()
external/bluetooth/bluez/android/avdtp.c:avdtp_unref() 0x4a27fc8: ref=1
external/bluetooth/bluez/android/avdtp.c:avdtp_unref() 0x4a27fc8: ref=0
external/bluetooth/bluez/android/avdtp.c:avdtp_free() 0x4a27fc8
==1225== Invalid write of size 4
==1225== at 0x11ABDE: session_cb (avdtp.c:2084)
==1225== by 0x48BD9C7: g_io_unix_dispatch (giounix.c:166)
==1225== by 0x48C2CCB: g_main_context_dispatch (gmain.c:2539)
==1225== by 0x48C2ED9: g_main_context_iterate.isra.19 (gmain.c:3146)
==1225== by 0x48C3167: g_main_loop_run (gmain.c:3340)
==1225== by 0x10D379: main (main.c:628)
==1225== Address 0x4a27fdc is 20 bytes inside a block of size 1,104 free'd
==1225== at 0x4897E6C: free (in /system/lib/valgrind/
vgpreload_memcheck-arm-linux.so)
==1225== by 0x48C5E2B: g_free (gmem.c:252)
==1225== by 0x11ABDB: session_cb (avdtp.c:2082)
==1225== by 0x48BD9C7: g_io_unix_dispatch (giounix.c:166)
==1225== by 0x48C2CCB: g_main_context_dispatch (gmain.c:2539)
==1225== by 0x48C2ED9: g_main_context_iterate.isra.19 (gmain.c:3146)
==1225== by 0x48C3167: g_main_loop_run (gmain.c:3340)
==1225== by 0x10D379: main (main.c:628)
==1225==
Diffstat (limited to 'android/avdtp.c')
| -rw-r--r-- | android/avdtp.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/android/avdtp.c b/android/avdtp.c index 970476a89..9f2527f82 100644 --- a/android/avdtp.c +++ b/android/avdtp.c @@ -2079,9 +2079,8 @@ next: return TRUE; failed: - connection_lost(session, EIO); - session->io_id = 0; + connection_lost(session, EIO); return FALSE; } |