From: Wootak Jung <wootak.jung@samsung.com>
Date: Thu, 20 Sep 2018 05:41:47 +0000 (+0900)
Subject: Fix memory double free(crash) issue
X-Git-Tag: accepted/tizen/unified/20180921.042519^0
X-Git-Url: http://review.tizen.org/git/?p=platform%2Fcore%2Fconnectivity%2Fbluetooth-frwk.git;a=commitdiff_plain;h=fa1f4e2938e9bd928283611631a2b636cf54d821

Fix memory double free(crash) issue

g_variant_get_string returns the constant string whereas
g_variant_get_dup_string returns a newly allocated string.
It should not be freed.

    at /usr/src/debug/bluetooth-frwk-0.3.0/bt-oal/bluez_hal/src/bt-hal-adapter-dbus-handler.c:525

Change-Id: I3d8f6bc0eec3d7736a263edbb47c3f3deaee4cef
---

diff --git a/bt-oal/bluez_hal/src/bt-hal-adapter-dbus-handler.c b/bt-oal/bluez_hal/src/bt-hal-adapter-dbus-handler.c
index e51c87e..835d8f8 100644
--- a/bt-oal/bluez_hal/src/bt-hal-adapter-dbus-handler.c
+++ b/bt-oal/bluez_hal/src/bt-hal-adapter-dbus-handler.c
@@ -522,14 +522,12 @@ static gboolean __bt_adapter_all_properties_cb(gpointer user_data)
 			size += __bt_insert_hal_properties(buf + size,
 					HAL_PROP_ADAPTER_ADDR, sizeof(bdaddr), bdaddr);
 			ev->num_props++;
-			g_free(address);
 		} else if (!g_strcmp0(key, "Alias")) {
 			name = (gchar *) g_variant_get_string(value, NULL);
 			DBG("Alias [%s]", name);
 			size += __bt_insert_hal_properties(buf + size,
 					HAL_PROP_ADAPTER_NAME, strlen(name) + 1, name);
 			ev->num_props++;
-			g_free(name);
 		} else if (!g_strcmp0(key, "Class")) {
 			cod = g_variant_get_uint32(value);
 			DBG("Class [%d]", cod);
@@ -566,7 +564,6 @@ static gboolean __bt_adapter_all_properties_cb(gpointer user_data)
 			size += __bt_insert_hal_properties(buf + size,
 					HAL_PROP_ADAPTER_NAME, strlen(name) + 1, name);
 			ev->num_props++;
-			g_free(name);
 		} else if (!g_strcmp0(key, "Powered")) {
 			powered = g_variant_get_boolean(value);
 			DBG("Powered = [%d]", powered);
diff --git a/bt-service-adaptation/services/bt-service-main.c b/bt-service-adaptation/services/bt-service-main.c
index dc349e2..fb1d227 100644
--- a/bt-service-adaptation/services/bt-service-main.c
+++ b/bt-service-adaptation/services/bt-service-main.c
@@ -170,7 +170,6 @@ static gboolean __bt_check_bt_service(void *data)
 #if 0
 	if (vconf_get_int(BT_OFF_DUE_TO_POWER_SAVING_MODE, &ps_mode_deactivation) != 0)
 		BT_ERR("Fail to get the ps_mode_deactivation value");
-	}
 #endif
 
 		if (vconf_get_int(BT_OFF_DUE_TO_TIMEOUT, &bt_off_due_to_timeout) != 0)
diff --git a/bt-service/bt-service-proximity.c b/bt-service/bt-service-proximity.c
index dadf5e4..55a75e4 100644
--- a/bt-service/bt-service-proximity.c
+++ b/bt-service/bt-service-proximity.c
@@ -198,7 +198,6 @@ int bt_get_proximity_property(bluetooth_device_address_t *device_address,
 	g_variant_unref(value);
 	g_object_unref(proxy);
 	g_free(property_str);
-	g_free(value_str);
 
 	return BLUETOOTH_ERROR_NONE;
 }