Don't use Address after it was deleted
Bug: 110216173
Change-Id: Id3364cf53153eafed478546d7347ed1673217e91
Merged-In: Id3364cf53153eafed478546d7347ed1673217e91
diff --git a/bta/dm/bta_dm_act.c b/bta/dm/bta_dm_act.c
index bb8e0b5..d3f12d1 100644
--- a/bta/dm/bta_dm_act.c
+++ b/bta/dm/bta_dm_act.c
@@ -3332,12 +3332,16 @@
}
if (conn.link_down.is_removed)
{
- BTM_SecDeleteDevice(p_bda);
+ // p_bda points to security record, which is removed in
+ // BTM_SecDeleteDevice.
+ BD_ADDR addr_copy;
+ memcpy(addr_copy, p_bda, BD_ADDR_LEN);
+ BTM_SecDeleteDevice(addr_copy);
#if (BLE_INCLUDED == TRUE && BTA_GATT_INCLUDED == TRUE)
/* need to remove all pending background connection */
- BTA_GATTC_CancelOpen(0, p_bda, FALSE);
+ BTA_GATTC_CancelOpen(0, addr_copy, FALSE);
/* remove all cached GATT information */
- BTA_GATTC_Refresh(p_bda);
+ BTA_GATTC_Refresh(addr_copy);
#endif
}
diff --git a/stack/btm/btm_dev.c b/stack/btm/btm_dev.c
index 1d79caa..c6def65 100644
--- a/stack/btm/btm_dev.c
+++ b/stack/btm/btm_dev.c
@@ -164,17 +164,16 @@
}
-/*******************************************************************************
-**
-** Function BTM_SecDeleteDevice
-**
-** Description Free resources associated with the device.
-**
-** Parameters: bd_addr - BD address of the peer
-**
-** Returns TRUE if removed OK, FALSE if not found or ACL link is active
-**
-*******************************************************************************/
+/** Free resources associated with the device associated with |bd_addr| address.
+ *
+ * *** WARNING ***
+ * tBTM_SEC_DEV_REC associated with bd_addr becomes invalid after this function
+ * is called, also any of it's fields. i.e. if you use p_dev_rec->bd_addr, it is
+ * no longer valid!
+ * *** WARNING ***
+ *
+ * Returns true if removed OK, false if not found or ACL link is active.
+ */
BOOLEAN BTM_SecDeleteDevice (BD_ADDR bd_addr)
{
tBTM_SEC_DEV_REC *p_dev_rec;
@@ -188,9 +187,11 @@
if ((p_dev_rec = btm_find_dev(bd_addr)) != NULL)
{
+ BD_ADDR bda;
+ memcpy(bda, bd_addr, BD_ADDR_LEN);
btm_sec_free_dev(p_dev_rec);
/* Tell controller to get rid of the link key, if it has one stored */
- BTM_DeleteStoredLinkKey (p_dev_rec->bd_addr, NULL);
+ BTM_DeleteStoredLinkKey (bda, NULL);
}
return TRUE;
diff --git a/stack/include/btm_api.h b/stack/include/btm_api.h
index b3232f4..5df4ce2 100644
--- a/stack/include/btm_api.h
+++ b/stack/include/btm_api.h
@@ -3313,15 +3313,16 @@
UINT8 key_type, tBTM_IO_CAP io_cap, UINT8 pin_length);
-/*******************************************************************************
-**
-** Function BTM_SecDeleteDevice
-**
-** Description Free resources associated with the device.
-**
-** Returns TRUE if rmoved OK, FALSE if not found
-**
-*******************************************************************************/
+/** Free resources associated with the device associated with |bd_addr| address.
+ *
+ * *** WARNING ***
+ * tBTM_SEC_DEV_REC associated with bd_addr becomes invalid after this function
+ * is called, also any of it's fields. i.e. if you use p_dev_rec->bd_addr, it is
+ * no longer valid!
+ * *** WARNING ***
+ *
+ * Returns true if removed OK, false if not found or ACL link is active.
+ */
extern BOOLEAN BTM_SecDeleteDevice (BD_ADDR bd_addr);