diff options
| author | TreeHugger Robot <treehugger-gerrit@google.com> | 2017-07-18 03:09:22 +0000 |
|---|---|---|
| committer | Android (Google) Code Review <android-gerrit@google.com> | 2017-07-18 03:09:22 +0000 |
| commit | 734bb953057ca426b3568d0fe100043b5b221197 (patch) | |
| tree | c42b9003126b73dd555675a48dc28d6e4529a5ca | |
| parent | b2c785ac6c809b1cda60aaf791968f179a1d5d83 (diff) | |
| parent | 4982eb5df30cbcbee5c8b8807be95fdc6dfa63c5 (diff) | |
| download | bt-734bb953057ca426b3568d0fe100043b5b221197.tar.gz | |
Merge "Free p_pending_data from tBNEP_CONN to avoid potential memory leaks"
| -rw-r--r-- | stack/bnep/bnep_main.cc | 1 | ||||
| -rw-r--r-- | stack/bnep/bnep_utils.cc | 2 |
2 files changed, 2 insertions, 1 deletions
diff --git a/stack/bnep/bnep_main.cc b/stack/bnep/bnep_main.cc index 6c2af2264..c03a4af2d 100644 --- a/stack/bnep/bnep_main.cc +++ b/stack/bnep/bnep_main.cc @@ -525,6 +525,7 @@ static void bnep_data_ind(uint16_t l2cap_cid, BT_HDR* p_buf) { if (ctrl_type == BNEP_SETUP_CONNECTION_REQUEST_MSG && p_bcb->con_state != BNEP_STATE_CONNECTED && extension_present && p && rem_len) { + osi_free(p_bcb->p_pending_data); p_bcb->p_pending_data = (BT_HDR*)osi_malloc(rem_len + sizeof(BT_HDR)); memcpy((uint8_t*)(p_bcb->p_pending_data + 1), p, rem_len); p_bcb->p_pending_data->len = rem_len; diff --git a/stack/bnep/bnep_utils.cc b/stack/bnep/bnep_utils.cc index ecc7fcacc..df267d986 100644 --- a/stack/bnep/bnep_utils.cc +++ b/stack/bnep/bnep_utils.cc @@ -143,7 +143,7 @@ void bnepu_release_bcb(tBNEP_CONN* p_bcb) { /* Drop any response pointer we may be holding */ p_bcb->con_state = BNEP_STATE_IDLE; - p_bcb->p_pending_data = NULL; + osi_free_and_reset((void**)&p_bcb->p_pending_data); /* Free transmit queue */ while (!fixed_queue_is_empty(p_bcb->xmit_q)) { |