summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLuiz Augusto von Dentz <luiz.von.dentz@intel.com>2012-10-01 14:26:04 +0300
committerLuiz Augusto von Dentz <luiz.von.dentz@intel.com>2012-10-03 14:40:11 +0300
commit843a9745c242997d4cff54e39f44b0ea5a2146a3 (patch)
tree80f6af9a7ffe284775957fd1414324571ac3f26e
parent222cbfa1ca1b7cd58ff5dcab7ace82d430629c6c (diff)
downloadbluez-843a9745c242997d4cff54e39f44b0ea5a2146a3.tar.gz
AVRCP: Fix not removing session from player upon disconnect
Invalid read of size 8 at 0x1310E3: avrcp_unregister_player (avrcp.c:1604) by 0x13EB57: path_free (media.c:1834) by 0x123208: remove_interface.isra.1 (object.c:558) by 0x1238DD: g_dbus_unregister_interface (object.c:705) by 0x124BB8: media_server_remove (manager.c:1077) by 0x4E91C5C: g_slist_foreach (in /usr/lib64/libglib-2.0.so.0.3200.4) by 0x17B349: adapter_remove (adapter.c:2309) by 0x176F39: manager_cleanup (manager.c:290) by 0x120E65: main (main.c:555) Address 0x6685058 is 24 bytes inside a block of size 80 free'd at 0x4C279AE: free (vg_replace_malloc.c:427) by 0x4E7C50E: g_free (in /usr/lib64/libglib-2.0.so.0.3200.4) by 0x12FC97: state_changed (avrcp.c:1380) by 0x12D351: avctp_set_state (avctp.c:396) by 0x12D7B4: session_cb (avctp.c:601) by 0x4E76824: g_main_context_dispatch (in /usr/lib64/libglib-2.0.so.0.3200.4) by 0x4E76B57: ??? (in /usr/lib64/libglib-2.0.so.0.3200.4) by 0x4E76F51: g_main_loop_run (in /usr/lib64/libglib-2.0.so.0.3200.4) by 0x120E51: main (main.c:551)
-rw-r--r--audio/avrcp.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/audio/avrcp.c b/audio/avrcp.c
index 49f15505c..2e36fb7d0 100644
--- a/audio/avrcp.c
+++ b/audio/avrcp.c
@@ -1328,6 +1328,11 @@ static void state_changed(struct audio_device *dev, avctp_state_t old_state,
avctp_unregister_browsing_pdu_handler(
session->browsing_handler);
+ if (session->player != NULL)
+ session->player->sessions = g_slist_remove(
+ session->player->sessions,
+ session);
+
g_free(session);
break;
case AVCTP_STATE_CONNECTING: