mirrors/pipewire
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/pipewire/pipewire.git synced 2025-12-16 08:56:45 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

bluez5: fix a use-after-free on transport handle

Browse source 
'remove_dynamic_node()' reference transport after it got freed in 'spa_bt_transport_free()'.
This commit is contained in:
Huang-Huang Bao 2021-03-20 16:02:47 +08:00 • committed by Wim Taymans
parent 03ea1a2177
commit 6512c2b5f6
1 changed files with 3 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

5
spa/plugins/bluez5/bluez5-dbus.c
View file

@ -1438,11 +1438,12 @@ void spa_bt_transport_free(struct spa_bt_transport *transport)
transport->device->connected_profiles &= ~transport->profile; transport->device->connected_profiles &= ~transport->profile;
spa_list_remove(&transport->device_link); spa_list_remove(&transport->device_link);
} }
free(transport->path);
free(transport);
if (device && device->connected_profiles != prev_connected) if (device && device->connected_profiles != prev_connected)
spa_bt_device_emit_profiles_changed(device, device->profiles, prev_connected); spa_bt_device_emit_profiles_changed(device, device->profiles, prev_connected);
free(transport->path);
free(transport);
} }
int spa_bt_transport_acquire(struct spa_bt_transport *transport, bool optional) int spa_bt_transport_acquire(struct spa_bt_transport *transport, bool optional)