Free p_pending_data from tBNEP_CONN to avoid potential memory leaks

Bug: 63146105
Test: External script
Change-Id: I1281779ccf38d1d2dfb1a6dc0e45c0e533cabbca
Merged-In: I1281779ccf38d1d2dfb1a6dc0e45c0e533cabbca
(cherry picked from commit 4982eb5df30cbcbee5c8b8807be95fdc6dfa63c5)
(cherry picked from commit a654681c5558904a8abfa1bbab8eafb651c13231)
(cherry picked from commit 64a12d3b6e71d9161837f28ce18c34d924c2bafc)

diff --git a/stack/bnep/bnep_main.c b/stack/bnep/bnep_main.c
index f8267cd..a20e1cf 100644 (file)
--- a/stack/bnep/bnep_main.c
+++ b/stack/bnep/bnep_main.c
@@ -565,6 +565,8 @@ static void bnep_data_ind (UINT16 l2cap_cid, BT_HDR *p_buf)
             p_bcb->con_state != BNEP_STATE_CONNECTED &&
             extension_present && p && rem_len)
         {
+            if (p_bcb->p_pending_data)
+                GKI_freebuf (p_bcb->p_pending_data);
             p_bcb->p_pending_data = (BT_HDR *)GKI_getbuf (rem_len + sizeof(BT_HDR));
             if (p_bcb->p_pending_data)
             {

diff --git a/stack/bnep/bnep_utils.c b/stack/bnep/bnep_utils.c
index 356c29f..611cb12 100644 (file)
--- a/stack/bnep/bnep_utils.c
+++ b/stack/bnep/bnep_utils.c
@@ -150,6 +150,8 @@ void bnepu_release_bcb (tBNEP_CONN *p_bcb)
 
     /* Drop any response pointer we may be holding */
     p_bcb->con_state        = BNEP_STATE_IDLE;
+    if (p_bcb->p_pending_data)
+        GKI_freebuf (p_bcb->p_pending_data);
     p_bcb->p_pending_data   = NULL;
 
     /* Free transmit queue */