diff options
| author | Balamurugan Mahalingam <mbalamurugan@atheros.com> | 2010-10-19 18:00:14 +0530 |
|---|---|---|
| committer | Johan Hedberg <johan.hedberg@nokia.com> | 2010-10-19 16:42:37 +0300 |
| commit | 1a751f399f0914cd875dd0ebd3e2f59cb62e6be8 (patch) | |
| tree | eec2fbdaa763c207e3b8de82220e3561ba218c7c /compat | |
| parent | 85bf920f1f67d77ea2827e3f9ad78443cba1d9a1 (diff) | |
| download | bluez-1a751f399f0914cd875dd0ebd3e2f59cb62e6be8.tar.gz | |
Fix accessing freed memory
Crash is due to some junk characters in the device name.
The device name is copied from a string variable after freeing the memory
it points to, so there were some junk characters in it which was the reason
for the crash.
Fixing the issue by freeing the memory in string variable after
device name is copied.
Diffstat (limited to 'compat')
| -rw-r--r-- | compat/sdp.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/compat/sdp.c b/compat/sdp.c index 88981363..ff2e39f8 100644 --- a/compat/sdp.c +++ b/compat/sdp.c @@ -152,7 +152,6 @@ int get_stored_device_info(const bdaddr_t *src, const bdaddr_t *dst, struct hidp &vendor, &product, &version, &subclass, &country, &parser, desc, &req->flags, &pos); - free(str); req->vendor = vendor; req->product = product; @@ -163,6 +162,7 @@ int get_stored_device_info(const bdaddr_t *src, const bdaddr_t *dst, struct hidp snprintf(req->name, 128, "%s", str + pos); + free(str); req->rd_size = strlen(desc) / 2; req->rd_data = malloc(req->rd_size); if (!req->rd_data) { |