diff options
author | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2012-10-01 14:26:04 +0300 |
---|---|---|
committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2012-10-03 14:40:11 +0300 |
commit | 843a9745c242997d4cff54e39f44b0ea5a2146a3 (patch) | |
tree | 80f6af9a7ffe284775957fd1414324571ac3f26e | |
parent | 222cbfa1ca1b7cd58ff5dcab7ace82d430629c6c (diff) | |
download | bluez-843a9745c242997d4cff54e39f44b0ea5a2146a3.tar.gz |
AVRCP: Fix not removing session from player upon disconnect
Invalid read of size 8
at 0x1310E3: avrcp_unregister_player (avrcp.c:1604)
by 0x13EB57: path_free (media.c:1834)
by 0x123208: remove_interface.isra.1 (object.c:558)
by 0x1238DD: g_dbus_unregister_interface (object.c:705)
by 0x124BB8: media_server_remove (manager.c:1077)
by 0x4E91C5C: g_slist_foreach (in /usr/lib64/libglib-2.0.so.0.3200.4)
by 0x17B349: adapter_remove (adapter.c:2309)
by 0x176F39: manager_cleanup (manager.c:290)
by 0x120E65: main (main.c:555)
Address 0x6685058 is 24 bytes inside a block of size 80 free'd
at 0x4C279AE: free (vg_replace_malloc.c:427)
by 0x4E7C50E: g_free (in /usr/lib64/libglib-2.0.so.0.3200.4)
by 0x12FC97: state_changed (avrcp.c:1380)
by 0x12D351: avctp_set_state (avctp.c:396)
by 0x12D7B4: session_cb (avctp.c:601)
by 0x4E76824: g_main_context_dispatch (in /usr/lib64/libglib-2.0.so.0.3200.4)
by 0x4E76B57: ??? (in /usr/lib64/libglib-2.0.so.0.3200.4)
by 0x4E76F51: g_main_loop_run (in /usr/lib64/libglib-2.0.so.0.3200.4)
by 0x120E51: main (main.c:551)
-rw-r--r-- | audio/avrcp.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/audio/avrcp.c b/audio/avrcp.c index 49f15505c..2e36fb7d0 100644 --- a/audio/avrcp.c +++ b/audio/avrcp.c @@ -1328,6 +1328,11 @@ static void state_changed(struct audio_device *dev, avctp_state_t old_state, avctp_unregister_browsing_pdu_handler( session->browsing_handler); + if (session->player != NULL) + session->player->sessions = g_slist_remove( + session->player->sessions, + session); + g_free(session); break; case AVCTP_STATE_CONNECTING: |