Paolo Bonzini 393c13b940 bt: stop the sdp memory allocation craziness ... Clang static analyzer reports a memory leak. Actually, the allocated memory escapes here: record->attribute_list[record->attributes].pair = data; but clang is correct that the memory might leak if len is zero. We know it isn't; assert that it is the case. The craziness doesn't end there. The memory is freed by bt_l2cap_sdp_close_ch: g_free(sdp->service_list[i].attribute_list->pair); which actually should have been written like this: g_free(sdp->service_list[i].attribute_list[0].pair); The attribute_list is sorted with qsort; but indeed the first entry of attribute_list should point to "data" even after the qsort, because the first record has id SDP_ATTR_RECORD_HANDLE, whose numeric value is zero. But hang on. The qsort function is static int sdp_attributeid_compare( const struct sdp_service_attribute_s *a, const struct sdp_service_attribute_s *b) { return (int) b->attribute_id - a->attribute_id; } but no one ever writes attribute_id. So it only works if qsort is stable, and who knows what else is broken, but we can fix it by setting attribute_id in the while loop. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>		2017-08-01 17:27:33 +02:00
..
core.c	hw: Clean up includes	2016-01-29 15:07:25 +00:00
hci-csr.c	be-hci: use backend functions	2017-06-02 11:33:53 +04:00
hci.c	hw/bt/hci: spelling fix: endianness	2016-09-13 18:12:34 +03:00
hid.c	hw: Clean up includes	2016-01-29 15:07:25 +00:00
l2cap.c	hw/bt: Don't use cpu_to_*w() and *_to_cpup()	2016-07-12 15:08:53 +01:00
Makefile.objs
sdp.c	bt: stop the sdp memory allocation craziness	2017-08-01 17:27:33 +02:00