system/bt
Revision | a61aaf1e3055bf96b205f419d024e644c37ae85e (tree) |
---|---|
Zeit | 2017-09-15 02:54:03 |
Autor | Pavlin Radoslavov <pavlin@goog...> |
Commiter | Dan Pasanen |
Free p_pending_data from tBNEP_CONN to avoid potential memory leaks
Bug: 63146105
Test: External script
Change-Id: I1281779ccf38d1d2dfb1a6dc0e45c0e533cabbca
Merged-In: I1281779ccf38d1d2dfb1a6dc0e45c0e533cabbca
(cherry picked from commit 4982eb5df30cbcbee5c8b8807be95fdc6dfa63c5)
(cherry picked from commit a654681c5558904a8abfa1bbab8eafb651c13231)
(cherry picked from commit 64a12d3b6e71d9161837f28ce18c34d924c2bafc)
(cherry picked from commit 8f18afd26c02ae3d46bf14d6e36017965dee0394)
(cherry picked from commit f8fc7f7d112d5ff2064aaaa3c7fceb077169183e)
@@ -575,6 +575,7 @@ static void bnep_data_ind (UINT16 l2cap_cid, BT_HDR *p_buf) | ||
575 | 575 | p_bcb->con_state != BNEP_STATE_CONNECTED && |
576 | 576 | extension_present && p && rem_len) |
577 | 577 | { |
578 | + osi_free(p_bcb->p_pending_data); | |
578 | 579 | p_bcb->p_pending_data = (BT_HDR *)osi_malloc(rem_len + sizeof(BT_HDR)); |
579 | 580 | memcpy((UINT8 *)(p_bcb->p_pending_data + 1), p, rem_len); |
580 | 581 | p_bcb->p_pending_data->len = rem_len; |
@@ -154,6 +154,7 @@ void bnepu_release_bcb (tBNEP_CONN *p_bcb) | ||
154 | 154 | |
155 | 155 | /* Drop any response pointer we may be holding */ |
156 | 156 | p_bcb->con_state = BNEP_STATE_IDLE; |
157 | + osi_free(p_bcb->p_pending_data); | |
157 | 158 | p_bcb->p_pending_data = NULL; |
158 | 159 | |
159 | 160 | /* Free transmit queue */ |