Parent: a09d1717e45d479aa04f497b1cf02172ebbf9111
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Committer: Johan Hedberg <johan.hedberg@intel.com>
Date: 2011-09-24 13:09:39
Tree: 7569c87981a39683e37969c8b13a02367b6c340b
Fix possible crash while removing a device If adapter has more than one sdp session active find_by_bdaddr always return the first one regardless if the device address match or not which leads to the following crash: Invalid read of size 4 at 0x16CB31: search_cb (in /usr/sbin/bluetoothd) by 0x15C0CA: connect_watch (in /usr/sbin/bluetoothd) by 0x48CFD37: g_io_unix_dispatch (in /usr/lib/libglib-2.0.so.0.2800.6) by 0x488B4A0: g_main_context_dispatch (in /usr/lib/libglib-2.0.so.0.2800.6) by 0x488BCD0: g_main_context_iterate.clone.5 (in /usr/lib/libglib-2.0.so.0.2800.6) by 0x488C3B8: g_main_loop_run (in /usr/lib/libglib-2.0.so.0.2800.6) by 0x152D09: main (in /usr/sbin/bluetoothd) Address 0x4c8c600 is 16 bytes inside a block of size 48 free'd at 0x48234A9: free (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so) by 0x48920F0: g_free (in /usr/lib/libglib-2.0.so.0.2800.6) by 0x16BDD3: browse_request_free (in /usr/sbin/bluetoothd) by 0x16C7A2: browse_request_cancel (in /usr/sbin/bluetoothd) Reported by Alberto José Rodríguez Rodríguez <ajrodriguez@blulabs.es>
Diffstat
| M | src/glib-helper.c | | | 8 | ++++++- - |
1 files changed, 6 insertions(+), 2 deletions(-)