Free p_pending_data from tBNEP_CONN to avoid potential memory leaks
Bug: 63146105
Test: External script
Change-Id: I1281779ccf38d1d2dfb1a6dc0e45c0e533cabbca
Merged-In: I1281779ccf38d1d2dfb1a6dc0e45c0e533cabbca
(cherry picked from commit 4982eb5df30cbcbee5c8b8807be95fdc6dfa63c5)
(cherry picked from commit a654681c5558904a8abfa1bbab8eafb651c13231)
diff --git a/stack/bnep/bnep_main.cc b/stack/bnep/bnep_main.cc
index ae3480d..b0fad6a 100644
--- a/stack/bnep/bnep_main.cc
+++ b/stack/bnep/bnep_main.cc
@@ -525,6 +525,7 @@
if (ctrl_type == BNEP_SETUP_CONNECTION_REQUEST_MSG &&
p_bcb->con_state != BNEP_STATE_CONNECTED && extension_present && p &&
rem_len) {
+ osi_free(p_bcb->p_pending_data);
p_bcb->p_pending_data = (BT_HDR*)osi_malloc(rem_len + sizeof(BT_HDR));
memcpy((uint8_t*)(p_bcb->p_pending_data + 1), p, rem_len);
p_bcb->p_pending_data->len = rem_len;
diff --git a/stack/bnep/bnep_utils.cc b/stack/bnep/bnep_utils.cc
index 3f5e13e..f2be411 100644
--- a/stack/bnep/bnep_utils.cc
+++ b/stack/bnep/bnep_utils.cc
@@ -144,7 +144,7 @@
/* Drop any response pointer we may be holding */
p_bcb->con_state = BNEP_STATE_IDLE;
- p_bcb->p_pending_data = NULL;
+ osi_free_and_reset((void**)&p_bcb->p_pending_data);
/* Free transmit queue */
while (!fixed_queue_is_empty(p_bcb->xmit_q)) {
