commit fc9dc800dad2234b80275eae5441041a60abd95c
author Myles Watson <mylesgw@google.com> Wed Mar 21 16:45:32 2018 -0700
committer android-build-team Robot <android-build-team-robot@google.com> Fri Aug 10 20:30:10 2018 +0000
tree ff67031baaa5aeb3ff232029cdd2248a812b0231
parent e9546029861dc15320d64d567a23ee453b323f52

PAN: Always allocate in bta_pan_data_buf_ind_cback

Change I63b857d031c55d3a0754e4101e330843eb422b2a caused a double
free.  Move the free call to pan_data_buf_ind_cb().

Free the buffer before every return in pan_data_buf_ind_cb.

Bug: 74950468
Test: manual tethering test with DUT sharing its connection
Change-Id: If4526f3042699581e2cdde79a362eef0f83768eb
Merged-In: If4526f3042699581e2cdde79a362eef0f83768eb
(cherry picked from commit 98232b084c66368234d19fafe3076bc1c0f1b578)

bta/pan/bta_pan_act.cc

diff --git a/bta/pan/bta_pan_act.cc b/bta/pan/bta_pan_act.cc
index 41e0bf6..789cce8 100644
--- a/bta/pan/bta_pan_act.cc
+++ b/bta/pan/bta_pan_act.cc
@@ -171,31 +171,25 @@
 static void bta_pan_data_buf_ind_cback(uint16_t handle, const RawAddress& src,
                                        const RawAddress& dst, uint16_t protocol,
                                        BT_HDR* p_buf, bool ext, bool forward) {
-  tBTA_PAN_SCB* p_scb;
-  BT_HDR* p_new_buf;
-
-  p_scb = bta_pan_scb_by_handle(handle);
+  tBTA_PAN_SCB* p_scb = bta_pan_scb_by_handle(handle);
   if (p_scb == NULL) {
     return;
   }
 
-  if (sizeof(tBTA_PAN_DATA_PARAMS) > p_buf->offset) {
-    /* offset smaller than data structure in front of actual data */
-    if (sizeof(BT_HDR) + sizeof(tBTA_PAN_DATA_PARAMS) + p_buf->len >
-        PAN_BUF_SIZE) {
-      android_errorWriteLog(0x534e4554, "63146237");
-      APPL_TRACE_ERROR("%s: received buffer length too large: %d", __func__,
-                       p_buf->len);
-      return;
-    }
-    p_new_buf = (BT_HDR*)osi_malloc(PAN_BUF_SIZE);
-    memcpy((uint8_t*)(p_new_buf + 1) + sizeof(tBTA_PAN_DATA_PARAMS),
-           (uint8_t*)(p_buf + 1) + p_buf->offset, p_buf->len);
-    p_new_buf->len = p_buf->len;
-    p_new_buf->offset = sizeof(tBTA_PAN_DATA_PARAMS);
-  } else {
-    p_new_buf = p_buf;
+  if (sizeof(BT_HDR) + sizeof(tBTA_PAN_DATA_PARAMS) + p_buf->len >
+      PAN_BUF_SIZE) {
+    android_errorWriteLog(0x534e4554, "63146237");
+    APPL_TRACE_ERROR("%s: received buffer length too large: %d", __func__,
+                     p_buf->len);
+    return;
   }
+
+  BT_HDR* p_new_buf = (BT_HDR*)osi_malloc(PAN_BUF_SIZE);
+  memcpy((uint8_t*)(p_new_buf + 1) + sizeof(tBTA_PAN_DATA_PARAMS),
+         (uint8_t*)(p_buf + 1) + p_buf->offset, p_buf->len);
+  p_new_buf->len = p_buf->len;
+  p_new_buf->offset = sizeof(tBTA_PAN_DATA_PARAMS);
+
   /* copy params into the space before the data */
   ((tBTA_PAN_DATA_PARAMS*)p_new_buf)->src = src;
   ((tBTA_PAN_DATA_PARAMS*)p_new_buf)->dst = dst;

stack/bnep/bnep_main.cc

diff --git a/stack/bnep/bnep_main.cc b/stack/bnep/bnep_main.cc
index f621fdb..463fca3 100644
--- a/stack/bnep/bnep_main.cc
+++ b/stack/bnep/bnep_main.cc
@@ -607,7 +607,6 @@
   if (bnep_cb.p_data_buf_cb) {
     (*bnep_cb.p_data_buf_cb)(p_bcb->handle, *p_src_addr, *p_dst_addr, protocol,
                              p_buf, fw_ext_present);
-    osi_free(p_buf);
   } else if (bnep_cb.p_data_ind_cb) {
     (*bnep_cb.p_data_ind_cb)(p_bcb->handle, *p_src_addr, *p_dst_addr, protocol,
                              p, rem_len, fw_ext_present);

stack/pan/pan_main.cc

diff --git a/stack/pan/pan_main.cc b/stack/pan/pan_main.cc
index d7cd27b..6a55423 100644
--- a/stack/pan/pan_main.cc
+++ b/stack/pan/pan_main.cc
@@ -595,12 +595,11 @@
       if (pan_cb.pan_data_buf_ind_cb)
         (*pan_cb.pan_data_buf_ind_cb)(pcb->handle, src, dst, protocol, p_buf,
                                       ext, forward);
-      else if (pan_cb.pan_data_ind_cb) {
+      else if (pan_cb.pan_data_ind_cb)
         (*pan_cb.pan_data_ind_cb)(pcb->handle, src, dst, protocol, p_data, len,
                                   ext, forward);
-        osi_free(p_buf);
-      }
 
+      osi_free(p_buf);
       return;
     }
 
@@ -625,13 +624,10 @@
   if (pan_cb.pan_data_buf_ind_cb)
     (*pan_cb.pan_data_buf_ind_cb)(pcb->handle, src, dst, protocol, p_buf, ext,
                                   forward);
-  else if (pan_cb.pan_data_ind_cb) {
+  else if (pan_cb.pan_data_ind_cb)
     (*pan_cb.pan_data_ind_cb)(pcb->handle, src, dst, protocol, p_data, len, ext,
                               forward);
-    osi_free(p_buf);
-  } else
-    osi_free(p_buf);
-
+  osi_free(p_buf);
   return;
 }