Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
avrcp: Fix crash while handling unsupported events
The following crash can be observed if the remote peer send and unsupported event: ERROR: AddressSanitizer: heap-use-after-free on address 0x60b000148f11 at pc 0x559644552088 bp 0x7ffe28b3c7b0 sp 0x7ffe28b3c7a0 WRITE of size 1 at 0x60b000148f11 thread T0 #0 0x559644552087 in avrcp_handle_event profiles/audio/avrcp.c:3907 ruundii#1 0x559644536c22 in control_response profiles/audio/avctp.c:939 bluez#2 0x5596445379ab in session_cb profiles/audio/avctp.c:1108 bluez#3 0x7fbcb3e51c43 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x55c43) bluez#4 0x7fbcb3ea66c7 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0xaa6c7) bluez#5 0x7fbcb3e512b2 in g_main_loop_run (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x552b2) bluez#6 0x559644754ab6 in mainloop_run src/shared/mainloop-glib.c:66 bluez#7 0x559644755606 in mainloop_run_with_signal src/shared/mainloop-notify.c:188 bluez#8 0x5596445bb963 in main src/main.c:1289 bluez#9 0x7fbcb3bafd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 bluez#10 0x7fbcb3bafe3f in __libc_start_main_impl ../csu/libc-start.c:392 bluez#11 0x5596444e8224 in _start (/usr/local/libexec/bluetooth/bluetoothd+0xf0224)
- Loading branch information