From: Alain Michaud <alainm@chromium.org>
Date: Mon, 1 Jun 2020 00:56:00 +0000 (+0000)
Subject: a2dp: Fix double free in load_remote_sep
X-Git-Tag: accepted/tizen/unified/20210607.124421~112
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=e00ebfee9c10b07461fb29c75168dda71e750028;p=platform%2Fupstream%2Fbluez.git

a2dp: Fix double free in load_remote_sep

This patch fixes a double free condition in load_remote_sep. Value is
freed, then the inner loop is broken, but the rest of the outer loop
will attempt to free value again.

Signed-off-by: Anuj Jain <anuj01.jain@samsung.com>
Signed-off-by: Ayush Garg <ayush.garg@samsung.com>
---

diff --git a/profiles/audio/a2dp.c b/profiles/audio/a2dp.c
index 4251a47..5f30fb0 100644
--- a/profiles/audio/a2dp.c
+++ b/profiles/audio/a2dp.c
@@ -2078,7 +2078,6 @@ static void load_remote_sep(struct a2dp_channel *chan, GKeyFile *key_file,
 
 			if (sscanf(caps + i, "%02hhx", tmp) != 1) {
 				warn("Unable to load Endpoint: seid %u", rseid);
-				g_free(value);
 				break;
 			}
 		}