Free p_pending_data from tBNEP_CONN to avoid potential memory leaks

Bug: 63146105
Test: External script
Change-Id: I1281779ccf38d1d2dfb1a6dc0e45c0e533cabbca

diff --git a/stack/bnep/bnep_main.cc b/stack/bnep/bnep_main.cc
index 6c2af22..c03a4af 100644 (file)
--- a/stack/bnep/bnep_main.cc
+++ b/stack/bnep/bnep_main.cc
@@ -525,6 +525,7 @@ static void bnep_data_ind(uint16_t l2cap_cid, BT_HDR* p_buf) {
       if (ctrl_type == BNEP_SETUP_CONNECTION_REQUEST_MSG &&
           p_bcb->con_state != BNEP_STATE_CONNECTED && extension_present && p &&
           rem_len) {
+        osi_free(p_bcb->p_pending_data);
         p_bcb->p_pending_data = (BT_HDR*)osi_malloc(rem_len + sizeof(BT_HDR));
         memcpy((uint8_t*)(p_bcb->p_pending_data + 1), p, rem_len);
         p_bcb->p_pending_data->len = rem_len;

diff --git a/stack/bnep/bnep_utils.cc b/stack/bnep/bnep_utils.cc
index 3c8e904..70fac8c 100644 (file)
--- a/stack/bnep/bnep_utils.cc
+++ b/stack/bnep/bnep_utils.cc
@@ -143,7 +143,7 @@ void bnepu_release_bcb(tBNEP_CONN* p_bcb) {
 
   /* Drop any response pointer we may be holding */
   p_bcb->con_state = BNEP_STATE_IDLE;
-  p_bcb->p_pending_data = NULL;
+  osi_free_and_reset((void**)&p_bcb->p_pending_data);
 
   /* Free transmit queue */
   while (!fixed_queue_is_empty(p_bcb->xmit_q)) {