[Bluez PATCH] device: fix temporary_timer double free
From: Archie Pusaka <hidden>
Date: 2020-10-20 10:03:04
Subsystem:
the rest · Maintainer:
Linus Torvalds
From: Archie Pusaka <redacted> One instance of freeing temporary_timer is not followed by setting the variable to 0, causing potential double free. Reviewed-by: Yun-Hao Chung <redacted> --- src/device.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/src/device.c b/src/device.c
index a5ef467301..2800b276a2 100644
--- a/src/device.c
+++ b/src/device.c@@ -4477,8 +4477,10 @@ void device_remove(struct btd_device *device, gboolean remove_stored) disconnect_all(device); } - if (device->temporary_timer > 0) + if (device->temporary_timer > 0) { g_source_remove(device->temporary_timer); + device->temporary_timer = 0; + } if (device->store_id > 0) { g_source_remove(device->store_id);
--
2.29.0.rc1.297.gfa9743e501-goog