Avoid null-pointer dereference in l2c_release_lcb()

Change-Id: Id46d678e45797c4d3d3c8e024f42cfd06b1d2da2

diff --git a/stack/l2cap/l2c_utils.c b/stack/l2cap/l2c_utils.c
index a4267a5..2c992d2 100644 (file)
--- a/stack/l2cap/l2c_utils.c
+++ b/stack/l2cap/l2c_utils.c
@@ -214,14 +214,18 @@ void l2cu_release_lcb (tL2C_LCB *p_lcb)
 #else
         btm_acl_removed (p_lcb->remote_bd_addr, BT_TRANSPORT_BR_EDR);
 #endif
+
     /* Release any held buffers */
-    while (!list_is_empty(p_lcb->link_xmit_data_q)) {
-        BT_HDR *p_buf = list_front(p_lcb->link_xmit_data_q);
-        list_remove(p_lcb->link_xmit_data_q, p_buf);
-        GKI_freebuf(p_buf);
+    if (p_lcb->link_xmit_data_q)
+    {
+        while (!list_is_empty(p_lcb->link_xmit_data_q)) {
+            BT_HDR *p_buf = list_front(p_lcb->link_xmit_data_q);
+            list_remove(p_lcb->link_xmit_data_q, p_buf);
+            GKI_freebuf(p_buf);
+        }
+        list_free(p_lcb->link_xmit_data_q);
+        p_lcb->link_xmit_data_q = NULL;
     }
-    list_free(p_lcb->link_xmit_data_q);
-    p_lcb->link_xmit_data_q = NULL;
 
 #if (L2CAP_UCD_INCLUDED == TRUE)
     /* clean up any security pending UCD */