[PATCH] Fix segfault when removing device

[PATCH] Fix segfault when removing device

[Bruna Moreira]

The device_register_services() function uses g_slist_concat(), therefore
the passed list should not be freed. The primary_cb() function from GATT
library was freeing the services list using discover_primary_free(). To
fix this, the device_register_services() function receives a copy of
services list if called from inside a gatt_discover_primary() callback.
---
 src/device.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/src/device.c b/src/device.c
index 44bf76f..72774bf 100644
--- a/src/device.c
+++ b/src/device.c
@@ -1600,7 +1600,7 @@ static void primary_cb(GSList *services, guint8 status, gpointer user_data)
 
 	device_probe_drivers(device, uuids);
 
-	device_register_services(req->conn, device, services, -1);
+	device_register_services(req->conn, device, g_slist_copy(services), -1);
 
 	g_slist_free(uuids);
 
-- 
1.7.0.4

Re: [PATCH] Fix segfault when removing device

[Johan Hedberg]

Hi Bruna,

On Mon, Apr 25, 2011, Bruna Moreira wrote:
> The device_register_services() function uses g_slist_concat(), therefore
> the passed list should not be freed. The primary_cb() function from GATT
> library was freeing the services list using discover_primary_free(). To
> fix this, the device_register_services() function receives a copy of
> services list if called from inside a gatt_discover_primary() callback.
> ---
>  src/device.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)

Pushed upstream. Thanks.

Johan