feedc0de/esp-idf
1
0
Fork 0
forked from espressif/esp-idf
Code Pull Requests Activity

Merge branch 'bugfix/sdp_remove_record_no_evt_v5.2' into 'release/v5.2'

Browse Source 
fix(bt/bluedroid): Fixed the crash caused by using illegal pointers during SDP deinit(v5.2)

See merge request espressif/esp-idf!29942
This commit is contained in:
Jiang Jiang Jian
2024-04-01 14:53:09 +08:00
parent 77920038f6 dfeeaf386e
commit a70bb45c48
1 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
components/bt/host/bluedroid/btc/profile/std/sdp/btc_sdp.c
View File

@ -1,5 +1,5 @@
/* /*
* SPDX-FileCopyrightText: 2015-2022 Espressif Systems (Shanghai) CO LTD * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
* *
* SPDX-License-Identifier: Apache-2.0 * SPDX-License-Identifier: Apache-2.0
*/ */
@ -285,8 +285,8 @@ static int free_sdp_slot(int id)
// Record have already been freed // Record have already been freed
handle = -1; handle = -1;
} }
osi_free(slot); osi_free(sdp_local_param.sdp_slots[id]);
slot = NULL; sdp_local_param.sdp_slots[id] = NULL;
return handle; return handle;
} }
@ -1034,14 +1034,16 @@ static void btc_sdp_remove_record(btc_sdp_args_t *arg)
} else { } else {
BTC_TRACE_ERROR("%s SDP record with handle %d not found", BTC_TRACE_ERROR("%s SDP record with handle %d not found",
__func__, arg->remove_record.record_handle); __func__, arg->remove_record.record_handle);
return; ret = ESP_SDP_NO_CREATE_RECORD;
break;
} }
/* Get the Record handle, and free the slot */ /* Get the Record handle, and free the slot */
/* The application layer record_handle is equivalent to the id of the btc layer */ /* The application layer record_handle is equivalent to the id of the btc layer */
int slot = get_sdp_slot_id_by_handle(arg->remove_record.record_handle); int slot = get_sdp_slot_id_by_handle(arg->remove_record.record_handle);
if (slot < 0) { if (slot < 0) {
return; ret = ESP_SDP_NO_CREATE_RECORD;
break;
} }
handle = free_sdp_slot(slot); handle = free_sdp_slot(slot);