commit e8bf02dd86458743c997b1f07dd742182171b866
author Łukasz Rymanowski <rlukasz@google.com> Wed Oct 12 11:24:05 2022 +0000
committer Łukasz Rymanowski <rlukasz@google.com> Wed Oct 12 14:42:26 2022 +0000
tree e6347cb36ca134ff1e7203d44f8db74255a139b1
parent 1a25b385a74aa649b87cf68697c344ba75e8b20d

bta_gattc: Fix initialization and free p_q_cmd

This will prevent crash when ACL is disconnected while GATT search

Bug: 253200147
Test: atest BluetoothInstrumentationTests
Test: manual disconnect while bonding and discovering
Tag: #feature
Change-Id: If7ad51378b650b67e551f8bbec7b38d0d9c14cbd

system/bta/gatt/bta_gattc_utils.cc

diff --git a/system/bta/gatt/bta_gattc_utils.cc b/system/bta/gatt/bta_gattc_utils.cc
index 1412702..6c483c1 100644
--- a/system/bta/gatt/bta_gattc_utils.cc
+++ b/system/bta/gatt/bta_gattc_utils.cc
@@ -146,6 +146,7 @@
       p_clcb->status = GATT_SUCCESS;
       p_clcb->transport = transport;
       p_clcb->bda = remote_bda;
+      p_clcb->p_q_cmd = NULL;
 
       p_clcb->p_rcb = bta_gattc_cl_get_regcb(client_if);
 
@@ -217,7 +218,9 @@
     p_srcb->gatt_database.Clear();
   }
 
-  osi_free_and_reset((void**)&p_clcb->p_q_cmd);
+  if (p_clcb->p_q_cmd != NULL) {
+    osi_free_and_reset((void**)&p_clcb->p_q_cmd);
+  }
   memset(p_clcb, 0, sizeof(tBTA_GATTC_CLCB));
 }