2011-04-25 18:48:10

by Bruna Moreira

Subject: [PATCH] Fix segfault when removing device

The device_register_services() function uses g_slist_concat(), therefore
the passed list should not be freed. The primary_cb() function from GATT
library was freeing the services list using discover_primary_free(). To
fix this, the device_register_services() function receives a copy of
services list if called from inside a gatt_discover_primary() callback.
---
src/device.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/src/device.c b/src/device.c
index 44bf76f..72774bf 100644
--- a/src/device.c
+++ b/src/device.c
@@ -1600,7 +1600,7 @@ static void primary_cb(GSList *services, guint8 status, gpointer user_data)

device_probe_drivers(device, uuids);

- device_register_services(req->conn, device, services, -1);
+ device_register_services(req->conn, device, g_slist_copy(services), -1);

g_slist_free(uuids);

--
1.7.0.4

2011-04-26 20:26:29

by Johan Hedberg

Subject: Re: [PATCH] Fix segfault when removing device

Hi Bruna,

On Mon, Apr 25, 2011, Bruna Moreira wrote:
> The device_register_services() function uses g_slist_concat(), therefore
> the passed list should not be freed. The primary_cb() function from GATT
> library was freeing the services list using discover_primary_free(). To
> fix this, the device_register_services() function receives a copy of
> services list if called from inside a gatt_discover_primary() callback.
> ---
> src/device.c | 2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)

Pushed upstream. Thanks.

Johan