michaelh/zephyr
1
0
Fork 0
Code Releases Activity

Bluetooth: Fix potential leak of dev.sent_cmd

Browse source 
In case we for some reason end up in a situation where we'd send
commands while dev.sent_cmd is already set, be sure to clean it away
to avoid potential buffer leaks.

Change-Id: I0aadb84086211e245cb6c1486af885d1dbabfa14
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
This commit is contained in:
Johan Hedberg 2015-04-28 15:16:03 +03:00 • committed by Anas Nashif
commit 0c397c6ca2
1 changed files with 10 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

11
net/bluetooth/hci_core.c
View file

@ -458,9 +458,18 @@ static void hci_cmd_fiber(void)
buf = nano_fifo_get_wait(&dev.cmd_queue);
dev.ncmd = 0;
BT_DBG("Sending command (buf %p) to driver\n", buf);
BT_DBG("Sending command %x (buf %p) to driver\n",
buf->hci.opcode, buf);
drv->send(buf);
/* Clear out any existing sent command */
if (dev.sent_cmd) {
BT_ERR("Uncleared pending sent_cmd\n");
bt_buf_put(dev.sent_cmd);
dev.sent_cmd = NULL;
}
dev.sent_cmd = buf;
}
}