core/gatt-database: Fix memory corruption Pointer to on-stack variable was returned from pending_write_new. #0 0x00007ffff72047b0 in __memmove_ssse3 () from /usr/lib/libc.so.6 #1 0x00007ffff78ae440 in ?? () from /usr/lib/libdbus-1.so.3 #2 0x00007ffff78ad7cc in ?? () from /usr/lib/libdbus-1.so.3 #3 0x00007ffff789ac46 in ?? () from /usr/lib/libdbus-1.so.3 #4 0x00000000004720e8 in write_setup_cb (iter=0x7fffffffe710, user_data=0x76c2a0) at src/gatt-database.c:1516 #5 0x00000000004b7b4c in g_dbus_proxy_method_call (proxy=0x75ade0, method=0x4e1747 "WriteValue", setup=0x472088 <write_setup_cb>, function=0x4720fd <write_reply_cb>, user_data=0x76c2a0, destroy=0x471f28 <pending_op_free>) at gdbus/client.c:875 #6 0x000000000047235f in send_write (attrib=0x764e00, proxy=0x75ade0, owner_queue=0x764250, id=1, value=0x767ff3 "\001\377\177", len=1) at src/gatt-database.c:1597 #7 0x0000000000472bdf in chrc_write_cb (attrib=0x764e00, id=1, offset=0, value=0x767ff3 "\001\377\177", len=1, opcode=82 'R', att=0x7606d0, user_data=0x7641d0) at src/gatt-database.c:1865 #8 0x00000000004c96f2 in gatt_db_attribute_write (attrib=0x764e00, offset=0, value=0x767ff3 "\001\377\177", len=1, opcode=82 'R', att=0x7606d0, func=0x4c53c8 <write_complete_cb>, user_data=0x772320) at src/shared/gatt-db.c:1570 #9 0x00000000004c5609 in write_cb (opcode=82 'R', pdu=0x767ff1, length=3, user_data=0x7630e0) at src/shared/gatt-server.c:796 #10 0x00000000004bdb35 in handle_notify (att=0x7606d0, opcode=82 'R', pdu=0x767ff1 "\f", pdu_len=3) at src/shared/att.c:768 #11 0x00000000004bddc9 in can_read_data (io=0x7607a0, user_data=0x7606d0) at src/shared/att.c:849 #12 0x00000000004c9c44 in watch_callback (channel=0x7607d0, cond=G_IO_IN, user_data=0x760940) at src/shared/io-glib.c:170 #13 0x00007ffff7b1662d in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0 #14 0x00007ffff7b16a08 in ?? () from /usr/lib/libglib-2.0.so.0 #15 0x00007ffff7b16d32 in g_main_loop_run () from /usr/lib/libglib-2.0.so.0 #16 0x0000000000466ba1 in main (argc=1, argv=0x7fffffffec38) at src/main.c:661

Diffstat

1 files changed, 4 insertions(+), 7 deletions(-)