diff options
| author | Syam Sidhardhan <s.syam@samsung.com> | 2013-01-21 19:03:29 +0530 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2013-01-22 13:30:30 +0200 |
| commit | 3021f18098c9d8761a47af8e7a17d1b963424d28 (patch) | |
| tree | 6bff376c7a392f081c9ffaf8fc8514fb3f30ae99 /profiles/health | |
| parent | da5596731b87341503652aa97430d1125279a60b (diff) | |
| download | bluez-3021f18098c9d8761a47af8e7a17d1b963424d28.tar.gz | |
health: Fix possible use after free
A pointer to freed memory is dereferenced if we call function
hdp_get_dcpsm_cb() with out any earlier reference.
Diffstat (limited to 'profiles/health')
| -rw-r--r-- | profiles/health/hdp.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/profiles/health/hdp.c b/profiles/health/hdp.c index c15f06af2..a42ca4816 100644 --- a/profiles/health/hdp.c +++ b/profiles/health/hdp.c @@ -542,9 +542,9 @@ static void hdp_get_dcpsm_cb(uint16_t dcpsm, gpointer user_data, GError *err) hdp_tmp_dc_data_destroy, &gerr)) return; - hdp_tmp_dc_data_unref(hdp_conn); hdp_conn->cb(hdp_chann->mdl, err, hdp_conn); g_error_free(gerr); + hdp_tmp_dc_data_unref(hdp_conn); } static void device_reconnect_mdl_cb(struct mcap_mdl *mdl, GError *err, |