Fixed incorrect update of transport->owners GSlist in media_transport_free.
Removal of list entries within 'for' loop leads to invalid read of memory
(l = l->next) and memory leaks.
---
audio/transport.c | 9 ++++++---
1 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/audio/transport.c b/audio/transport.c
index aa3308d..7c99207 100644
--- a/audio/transport.c
+++ b/audio/transport.c
@@ -808,10 +808,13 @@ static GDBusSignalTable transport_signals[] = {
static void media_transport_free(void *data)
{
struct media_transport *transport = data;
- GSList *l;
+ GSList *l = transport->owners;
- for (l = transport->owners; l; l = l->next)
- media_transport_remove(transport, l->data);
+ while (l) {
+ struct media_owner *owner = l->data;
+ l = l->next;
+ media_transport_remove(transport, owner);
+ }
g_slist_free(transport->owners);
--
1.7.4.1
--
To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
