Fix invalid memory access issues in AVDTP module Changing stream state from STREAMING to IDLE can be associated with side effects under some circumstances (such as terminating bluetoothd during music is streamed). In this case, after connection is lost, stream state changes from STREAMING to IDLE - "avdtp_sep_set_state" is triggered which invokes callback called "stream_state_changed" which internally invokes "avdtp_sep_set_state" (state of stream doesn't change and stays as IDLE) second time and then stream object is freed by "stream_free" at the end of "avdtp_sep_set_state". After returning from callback, first triggered "avdtp_sep_set_state" attempts to free stream object again ("if (state == AVDTP_STATE_IDLE)" condition is still satisfied) and it leads to invalid read/write/free issues (reported by valgrind) in "stream free" body, since "stream" is "alias" pointer to stream object which is already out of date (memory for stream object has been already freed). This patch prevents from this special case by freeing stream object only when it is present on streams list and removing from this list when stream object would be freed.

Diffstat

1 files changed, 4 insertions(+), 2 deletions(-)