From 09b6fbef703b8537775c3e923fa07b128a1fda0c Mon Sep 17 00:00:00 2001 From: Rafal Michalski Date: Fri, 27 May 2011 14:59:17 +0200 Subject: [PATCH] Fix invalid read of memory in avdtp module Fixed incorrect update of server->sessions GSlist in avdtp_exit. Previosly it was leading to invalid read of memory (l = l->next) (and possible memory leaks) since after invoking avdtp_unref in connection_lost, l pointer was not valid anymore (previously assignment l = l->next was used after invoking connection_lost in for loop). --- audio/avdtp.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/audio/avdtp.c b/audio/avdtp.c index 252810e8a..7e398dba8 100644 --- a/audio/avdtp.c +++ b/audio/avdtp.c @@ -3861,9 +3861,15 @@ void avdtp_exit(const bdaddr_t *src) if (!server) return; - for (l = server->sessions; l; l = l->next) { + l = server->sessions; + while (l) { struct avdtp *session = l->data; + l = l->next; + /* value of l pointer should be updated before invoking + * connection_lost since it internally uses avdtp_unref + * which operates on server->session list as well + */ connection_lost(session, -ECONNABORTED); } -- 2.47.3