Hi Luiz,
On Tue, Dec 3, 2013 at 5:36 AM, Luiz Augusto von Dentz
<luiz.dentz@xxxxxxxxx> wrote:
> --- a/profiles/audio/avctp.c
> +++ b/profiles/audio/avctp.c
> @@ -1488,7 +1488,7 @@ static struct avctp_pending_req *pending_create(struct avctp_channel *chan,
> tmp = g_slist_copy(chan->processed);
>
> /* Find first unused transaction id */
> - for (l = tmp; l; l = l->next) {
> + for (l = tmp; l; l = g_slist_next(l)) {
Are you sure this fixes the problem? AFAIK g_list_next() will still
access invalid memory unless the "next" pointer is saved *before* the
current entry is freed. See e.g. remove_temp_devices() in
src/adapter.c.
> struct avctp_pending_req *req = l->data;
>
> if (req->transaction == chan->transaction) {
Best Regards,
--
Anderson Lizardo
Instituto Nokia de Tecnologia - INdT
Manaus - Brazil
--
To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
