Branch: refs/heads/master Home: https://github.com/bluez/bluez Commit: f1069c4fe1060dec1565eef3d2b1ec31ed713fba https://github.com/bluez/bluez/commit/f1069c4fe1060dec1565eef3d2b1ec31ed713fba Author: Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx> Date: 2022-05-20 (Fri, 20 May 2022) Changed paths: M src/shared/gatt-server.c Log Message: ----------- gatt-server: Fix crash while disconnecting If there is a pending notify multiple the code was not removing before freeing the object causing the following crash: Invalid read of size 8 at 0x4A3D10: notify_multiple (gatt-server.c:1703) by 0x4D05F0: timeout_callback (timeout-glib.c:25) by 0x4956900: ??? (in /usr/lib64/libglib-2.0.so.0.7000.5) by 0x49560AE: g_main_context_dispatch (in /usr/lib64/libglib-2.0.so.0.7000.5) by 0x49AB307: ??? (in /usr/lib64/libglib-2.0.so.0.7000.5) by 0x49557C2: g_main_loop_run (in /usr/lib64/libglib-2.0.so.0.7000.5) by 0x4D0A34: mainloop_run (mainloop-glib.c:66) by 0x4D0F2B: mainloop_run_with_signal (mainloop-notify.c:188) by 0x2B0CD1: main (main.c:1276) Address 0x6ca35c8 is 136 bytes inside a block of size 144 free'd at 0x48470E4: free (vg_replace_malloc.c:872) by 0x415E73: gatt_server_cleanup (device.c:698) by 0x415E73: attio_cleanup (device.c:715) by 0x47745B: queue_foreach (queue.c:207) by 0x490C54: disconnect_cb (att.c:701) by 0x4CF4AF: watch_callback (io-glib.c:157) by 0x49560AE: g_main_context_dispatch (in /usr/lib64/libglib-2.0.so.0.7000.5) by 0x49AB307: ??? (in /usr/lib64/libglib-2.0.so.0.7000.5) by 0x49557C2: g_main_loop_run (in /usr/lib64/libglib-2.0.so.0.7000.5) by 0x4D0A34: mainloop_run (mainloop-glib.c:66) by 0x4D0F2B: mainloop_run_with_signal (mainloop-notify.c:188) by 0x2B0CD1: main (main.c:1276)
