Fix the crash

- le_adv_slot is accessed in __bt_hold_current_advertising_timeout_cb()
      after it's freed.

Change-Id: Id9c394e07f33c8df09b6a8c0f07f0e0afe4b9294
Signed-off-by: injun.yang <injun.yang@samsung.com>

diff --git a/bt-service/bt-service-adapter-le.c b/bt-service/bt-service-adapter-le.c
index a9f61d1..56a2ff8 100644 (file)
--- a/bt-service/bt-service-adapter-le.c
+++ b/bt-service/bt-service-adapter-le.c
@@ -171,6 +171,8 @@ void __bt_free_le_adv_slot(void)
        for (i = 0; i < le_feature_info.adv_inst_max; i++) {
                if (le_adv_slot[i].sender)
                        g_free(le_adv_slot[i].sender);
+               if (le_adv_slot[i].hold_timer_id > 0)
+                       g_source_remove(le_adv_slot[i].hold_timer_id);
        }
        g_free(le_adv_slot);
        le_adv_slot = NULL;