a2dp: Fix double free in load_remote_sep
authorAlain Michaud <alainm@chromium.org>
Mon, 1 Jun 2020 00:56:00 +0000 (00:56 +0000)
committerAyush Garg <ayush.garg@samsung.com>
Mon, 12 Apr 2021 09:00:49 +0000 (14:30 +0530)
This patch fixes a double free condition in load_remote_sep. Value is
freed, then the inner loop is broken, but the rest of the outer loop
will attempt to free value again.

Signed-off-by: Anuj Jain <anuj01.jain@samsung.com>
Signed-off-by: Ayush Garg <ayush.garg@samsung.com>
profiles/audio/a2dp.c

index 4251a47..5f30fb0 100644 (file)
@@ -2078,7 +2078,6 @@ static void load_remote_sep(struct a2dp_channel *chan, GKeyFile *key_file,
 
                        if (sscanf(caps + i, "%02hhx", tmp) != 1) {
                                warn("Unable to load Endpoint: seid %u", rseid);
-                               g_free(value);
                                break;
                        }
                }