Fix the crash in the fail case

Change-Id: Ie2119a33789874a63f71a9178ab1e2344a2205de
Signed-off-by: DoHyun Pyun <dh79.pyun@samsung.com>

diff --git a/bt-service/bt-service-otp.c b/bt-service/bt-service-otp.c
index afe4232..17a2669 100644 (file)
--- a/bt-service/bt-service-otp.c
+++ b/bt-service/bt-service-otp.c
@@ -120,10 +120,9 @@ void server_init_cb(GObject *object, GAsyncResult *res,
                        g_clear_error(&error);
                        status = BLUETOOTH_ERROR_INTERNAL;
                }
-       }
-
-       if (result) {
+       } else {
                g_variant_get(result, "(i)", &status);
+               g_variant_unref(result);
        }
 
        BT_DBG("Status [%d]", status);
@@ -141,7 +140,7 @@ void server_init_cb(GObject *object, GAsyncResult *res,
                param);
 
        out_param = g_variant_new_from_data((const GVariantType*)"i",
-                               result, sizeof(int), TRUE, NULL, NULL);
+                               &status, sizeof(int), TRUE, NULL, NULL);
 
        if (req_info) {
                g_dbus_method_invocation_return_value(req_info->context,
@@ -149,8 +148,6 @@ void server_init_cb(GObject *object, GAsyncResult *res,
 
                _bt_delete_request_list(req_info->req_id);
        }
-
-       g_variant_unref(result);
 }
 
 int bt_otp_server_init(int request_id, const char *directory)
@@ -201,10 +198,9 @@ void server_deinit_cb(GObject *object, GAsyncResult *res,
                        g_clear_error(&error);
                        status = BLUETOOTH_ERROR_INTERNAL;
                }
-       }
-
-       if (result) {
+       } else {
                g_variant_get(result, "(i)", &status);
+               g_variant_unref(result);
        }
 
        BT_DBG("Status [%d]", status);
@@ -220,7 +216,7 @@ void server_deinit_cb(GObject *object, GAsyncResult *res,
 
        if (req_info) {
                out_param = g_variant_new_from_data((const GVariantType*)"i",
-                               result, sizeof(int), TRUE, NULL, NULL);
+                               &status, sizeof(int), TRUE, NULL, NULL);
 
                g_dbus_method_invocation_return_value(req_info->context,
                                g_variant_new("(iv)", status, out_param));
@@ -228,8 +224,6 @@ void server_deinit_cb(GObject *object, GAsyncResult *res,
                _bt_delete_request_list(req_info->req_id);
        }
 
-       g_variant_unref(result);
-
        if (otp_gproxy) {
                g_object_unref(otp_gproxy);
                otp_gproxy = NULL;
@@ -370,11 +364,10 @@ dbus_return:
                _bt_send_event_to_dest(info->sender, BT_OTP_EVENT,
                                BLUETOOTH_EVENT_OTP_READ_CHAR_VAL,
                                param);
+               req_info = _bt_get_request_info(info->req_id);
+               __bt_otp_remove_read_info(info);
        }
 
-       req_info = _bt_get_request_info(info->req_id);
-       __bt_otp_remove_read_info(info);
-
        if (req_info == NULL) {
                BT_ERR("OTP data read Request not found!!");
                goto done;
@@ -411,7 +404,7 @@ int _bt_otp_read_characteristic_value(int request_id, char *sender, char *handle
 {
        GDBusConnection *conn;
        bt_otp_read_req_info *info = NULL;
-       char *charc_handle = g_strdup(handle);
+       char *charc_handle = NULL;
        GVariantBuilder *builder = NULL;
        guint16 offset = 0;
 
@@ -425,8 +418,7 @@ int _bt_otp_read_characteristic_value(int request_id, char *sender, char *handle
 
        /* If OTP data read already pending on same Server, then return In progress */
        if (__bt_otp_get_read_info(handle) != NULL) {
-               BT_ERR("Read Req is ongoing in remote server [%s]", charc_handle);
-               g_free(charc_handle);
+               BT_ERR("Read Req is ongoing in remote server [%s]", handle);
                return BLUETOOTH_ERROR_IN_PROGRESS;
        }
 
@@ -435,6 +427,8 @@ int _bt_otp_read_characteristic_value(int request_id, char *sender, char *handle
        g_variant_builder_add(builder, "{sv}", "offset",
                g_variant_new("q", offset));
 
+       charc_handle = g_strdup(handle);
+
        g_dbus_connection_call(conn,
                        BT_BLUEZ_NAME,
                        handle,
@@ -588,7 +582,7 @@ done:
 int _bt_otp_enable_notification(int request_id, char *sender, char *handle)
 {
        bt_otp_notification_info *info = NULL;
-       char *charc_handle = g_strdup(handle);
+       char *charc_handle = NULL;
        GDBusConnection *conn;
 
        BT_CHECK_PARAMETER(handle, return);
@@ -601,10 +595,11 @@ int _bt_otp_enable_notification(int request_id, char *sender, char *handle)
 
        if (__bt_otp_get_notification_info(handle) != NULL) {
                BT_ERR("Activation is already ongoing for same remote server");
-               g_free(charc_handle);
                return BLUETOOTH_ERROR_IN_PROGRESS;
        }
 
+       charc_handle = g_strdup(handle);
+
        BT_INFO("Start Notify to Bluez");
        g_dbus_connection_call(conn,
                        BT_BLUEZ_NAME,
@@ -739,7 +734,7 @@ int _bt_otp_write_characteristic_value(int request_id, char *sender, char *handl
        guint16 offset = 0;
        bt_otp_notification_info *info = NULL;
        GDBusConnection *conn;
-       char *charc_handle = g_strdup(handle);
+       char *charc_handle = NULL;
        int i;
 
        BT_DBG("+");
@@ -757,7 +752,6 @@ int _bt_otp_write_characteristic_value(int request_id, char *sender, char *handl
        info = __bt_otp_get_notification_info(handle);
        if (info && info->notification_timeout_id > 0) {
                BT_ERR("Write Request is already ongoing in remote server");
-               g_free(charc_handle);
                return BLUETOOTH_ERROR_IN_PROGRESS;
        }
 
@@ -775,6 +769,8 @@ int _bt_otp_write_characteristic_value(int request_id, char *sender, char *handl
 
        options = g_variant_new("a{sv}", builder2);
 
+       charc_handle = g_strdup(handle);
+
        /* Activate Control Point */
        g_dbus_connection_call(conn,
                        BT_BLUEZ_NAME,