commit 5340dae86f4e2bb697cccd0f586501b52a784db5
author Jizhou Liao <Jizhou.Liao@nxp.com> Tue Mar 22 12:08:11 2016 -0700
committer Martijn Coenen <maco@google.com> Wed May 11 19:25:01 2016 +0200
tree ca67be2e117d2f308bdb3e7c5bdf11847a0e9428
parent b1b86f94acdddb55f0f13bc959ddfa9289f4cf2e

Free memory in case of error response

In case of NFC_DATA_CEVT with error response,
p_data is allocated as p_msg from nfc_main_hal_data_cback(),
here to free this buffer to avoid memory leak.

Bug: 28181917
Change-Id: I74bbb5c2f7956eb246b38c25a1e8c56922ee56ab

src/nfc/tags/rw_t1t.c

diff --git a/src/nfc/tags/rw_t1t.c b/src/nfc/tags/rw_t1t.c
index e7d373e..1fd074e 100644
--- a/src/nfc/tags/rw_t1t.c
+++ b/src/nfc/tags/rw_t1t.c
@@ -254,11 +254,19 @@
         break;
 
     case NFC_DATA_CEVT:
-        if (  (p_data != NULL)
-            &&(p_data->data.status == NFC_STATUS_OK)  )
+        if (p_data != NULL)
         {
-            rw_t1t_data_cback (conn_id, event, p_data);
-            break;
+            if (p_data->data.status == NFC_STATUS_OK)
+            {
+                rw_t1t_data_cback (conn_id, event, p_data);
+                break;
+            }
+            else if (p_data->data.p_data != NULL)
+            {
+                /* Free the response buffer in case of error response */
+                GKI_freebuf ((BT_HDR *) (p_data->data.p_data));
+                p_data->data.p_data = NULL;
+            }
         }
         /* Data event with error status...fall through to NFC_ERROR_CEVT case */
 

src/nfc/tags/rw_t2t.c

diff --git a/src/nfc/tags/rw_t2t.c b/src/nfc/tags/rw_t2t.c
index de2de64..3976b3b 100644
--- a/src/nfc/tags/rw_t2t.c
+++ b/src/nfc/tags/rw_t2t.c
@@ -297,12 +297,20 @@
         break;
 
     case NFC_DATA_CEVT:
-        if (  (p_data != NULL)
-            &&(  (p_data->data.status == NFC_STATUS_OK)
-               ||(p_data->data.status == NFC_STATUS_CONTINUE)  )  )
+        if (p_data != NULL)
         {
-            rw_t2t_proc_data (conn_id, &(p_data->data));
-            break;
+            if ( (p_data->data.status == NFC_STATUS_OK)
+               ||(p_data->data.status == NFC_STATUS_CONTINUE) )
+            {
+                rw_t2t_proc_data (conn_id, &(p_data->data));
+                break;
+            }
+            else if (p_data->data.p_data != NULL)
+            {
+                /* Free the response buffer in case of error response */
+                GKI_freebuf ((BT_HDR *) (p_data->data.p_data));
+                p_data->data.p_data = NULL;
+            }
         }
         /* Data event with error status...fall through to NFC_ERROR_CEVT case */
 

src/nfc/tags/rw_t3t.c

diff --git a/src/nfc/tags/rw_t3t.c b/src/nfc/tags/rw_t3t.c
index 7db0fac..f8ec361 100644
--- a/src/nfc/tags/rw_t3t.c
+++ b/src/nfc/tags/rw_t3t.c
@@ -2369,6 +2369,12 @@
             rw_t3t_data_cback (conn_id, &(p_data->data));
             break;
         }
+        else if (p_data->data.p_data != NULL)
+        {
+            /* Free the response buffer in case of error response */
+            GKI_freebuf ((BT_HDR *) (p_data->data.p_data));
+            p_data->data.p_data = NULL;
+        }
         /* Data event with error status...fall through to NFC_ERROR_CEVT case */