Merge "PAN: Fix Use-after-free in bta_pan_data_buf_ind_cback" into oc-dev am: 4583cab341

am: 6c59a050b9

Change-Id: I1664cb5b316315f50a04bc3eafad818071978b7b

diff --cc bta/pan/bta_pan_act.cc
Simple merge

diff --cc stack/bnep/bnep_main.cc
index 475cc28,17d35eb..cf7a911
--- 1/stack/bnep/bnep_main.cc
--- 2/stack/bnep/bnep_main.cc
+++ b/stack/bnep/bnep_main.cc
@@@ -599,11 -603,12 +599,12 @@@ static void bnep_data_ind(uint16_t l2ca
      fw_ext_present = false;
  
    if (bnep_cb.p_data_buf_cb) {
 -    (*bnep_cb.p_data_buf_cb)(p_bcb->handle, p_src_addr, p_dst_addr, protocol,
 +    (*bnep_cb.p_data_buf_cb)(p_bcb->handle, *p_src_addr, *p_dst_addr, protocol,
                               p_buf, fw_ext_present);
+     osi_free(p_buf);
    } else if (bnep_cb.p_data_ind_cb) {
 -    (*bnep_cb.p_data_ind_cb)(p_bcb->handle, p_src_addr, p_dst_addr, protocol, p,
 -                             rem_len, fw_ext_present);
 +    (*bnep_cb.p_data_ind_cb)(p_bcb->handle, *p_src_addr, *p_dst_addr, protocol,
 +                             p, rem_len, fw_ext_present);
      osi_free(p_buf);
    }
  }