commit c4a34b7f6a02feacd3795345efc4df2924c293e2
author Joseph Pirozzo <pirozzoj@google.com> Mon Apr 30 12:23:18 2018 -0700
committer Joseph Pirozzo <pirozzoj@google.com> Mon Apr 30 13:32:24 2018 -0700
tree ec9a53288c1232e87c2ffe153201be7d6fb8f436
parent d3af716a7ecc86ceb894c15d5a8d5ce21935ef0c

Fix memory leak for BTRC_ITEM_MEDIA.

Memory is allocated for each media item received from a remote phone for
AVRCP media browsing.  Although the media item itself was freed, the
memory for each attribute was not freed.  Move the allocation up to
the parent function such that it can be allocated and freed in the same
location.

Bug: 78222934
Test: dumpsys meminfo com.android.bluetooth
Change-Id: I217830441949642cd6ef0f96ac5fde9251452095

system/btif/src/btif_rc.cc

diff --git a/system/btif/src/btif_rc.cc b/system/btif/src/btif_rc.cc
index 861b1c2d..d3fb5f0 100644
--- a/system/btif/src/btif_rc.cc
+++ b/system/btif/src/btif_rc.cc
@@ -3894,6 +3894,10 @@
       switch (avrc_item->item_type) {
         case AVRC_ITEM_MEDIA:
           BTIF_TRACE_DEBUG("%s setting type to %d", __func__, BTRC_ITEM_MEDIA);
+          /* Allocate Space for Attributes */
+          btrc_item->media.num_attrs = avrc_item->u.media.attr_count;
+          btrc_item->media.p_attrs = (btrc_element_attr_val_t*)osi_malloc(
+              btrc_item->media.num_attrs * sizeof(btrc_element_attr_val_t));
           get_folder_item_type_media(avrc_item, btrc_item);
           break;
 
@@ -3919,7 +3923,22 @@
               (const btrc_folder_items_t*)btrc_items, item_count);
     BTIF_TRACE_DEBUG("%s HAL CBACK get_folder_items_cb finished", __func__);
 
-    /* Release the memory block for items since we OWN the object */
+    /* Release the memory block for items and attributes allocated here */
+    for (uint8_t i = 0; i < item_count; i++) {
+      btrc_folder_items_t* btrc_item = &(btrc_items[i]);
+      switch (btrc_item->item_type) {
+        case BTRC_ITEM_MEDIA:
+          osi_free(btrc_item->media.p_attrs);
+          break;
+        case BTRC_ITEM_PLAYER:
+        case BTRC_ITEM_FOLDER:
+          /*Nothing to free*/
+          break;
+        default:
+          BTIF_TRACE_WARNING("%s free unspecified type", __func__);
+      }
+    }
+
     osi_free(btrc_items);
   } else {
     BTIF_TRACE_ERROR("%s: Error %d", __func__, p_rsp->status);
@@ -3967,11 +3986,6 @@
   memcpy(btrc_item_media->name, avrc_item_media->name.p_str,
          sizeof(uint8_t) * (avrc_item_media->name.str_len));
 
-  /* Copy the parameters */
-  btrc_item_media->num_attrs = avrc_item_media->attr_count;
-  btrc_item_media->p_attrs = (btrc_element_attr_val_t*)osi_malloc(
-      btrc_item_media->num_attrs * sizeof(btrc_element_attr_val_t));
-
   /* Extract each attribute */
   for (int i = 0; i < avrc_item_media->attr_count; i++) {
     btrc_element_attr_val_t* btrc_attr_pair = &(btrc_item_media->p_attrs[i]);
@@ -4092,6 +4106,8 @@
   btrc_item_player->major_type = avrc_item_player->major_type;
   /* Sub type */
   btrc_item_player->sub_type = avrc_item_player->sub_type;
+  /* Play status */
+  btrc_item_player->play_status = avrc_item_player->play_status;
   /* Features */
   memcpy(btrc_item_player->features, avrc_item_player->features,
          BTRC_FEATURE_BIT_MASK_SIZE);