diff options
| author | Silviu Florian Barbulescu <silviu.barbulescu@nxp.com> | 2024-02-23 16:16:09 +0200 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2024-02-23 09:47:15 -0500 |
| commit | 8f262a27bdf233f142a7bb22bf3f8c6db53debee (patch) | |
| tree | 60867adc3a6a0d52a9178280e8441fe033b58c98 | |
| parent | a16c2ccf9c256285188f4549b7b767cf31b100eb (diff) | |
shared/bap: Fix crash unreg bcast src endpoint
In bt_bap_stream_release stream is accessed after free
| -rw-r--r-- | src/shared/bap.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/src/shared/bap.c b/src/shared/bap.c index f5fc140270..626e8f1279 100644 --- a/src/shared/bap.c +++ b/src/shared/bap.c @@ -5411,16 +5411,17 @@ unsigned int bt_bap_stream_release(struct bt_bap_stream *stream, void *user_data) { unsigned int id; + struct bt_bap *bap = stream->bap; if (!stream || !stream->ops || !stream->ops->release) return 0; - if (!bt_bap_ref_safe(stream->bap)) + if (!bt_bap_ref_safe(bap)) return 0; id = stream->ops->release(stream, func, user_data); - bt_bap_unref(stream->bap); + bt_bap_unref(bap); return id; } |