From 1f19de06e2523356ae3ae909a1e14ab157591adb Mon Sep 17 00:00:00 2001
From: Smriti Gupta <smritig@codeaurora.org>
Date: Sat, 30 Jul 2016 16:40:55 +0530
Subject: [PATCH] FM: Fix KW issues found in FM
Fix KW issues found in FM.
CRs-Fixed: 1048393
Change-Id: I1e47753f96307005ebe1a90254fe885295c04669
---
fm_hci/fm_hci.c | 16 ++++++++++++++--
helium/radio_helium_hal.c | 11 ++++++-----
2 files changed, 20 insertions(+), 7 deletions(-)
diff --git a/fm_hci/fm_hci.c b/fm_hci/fm_hci.c
index 74c0ac9..8c6173a 100644
--- a/fm_hci/fm_hci.c
+++ b/fm_hci/fm_hci.c
@@ -273,14 +273,26 @@ static void *hci_read_thread(void *arg)
struct fm_event_header_t *evt_buf = (struct fm_event_header_t *) malloc(sizeof(struct fm_event_header_t) + MAX_FM_EVT_PARAMS);
- if (!evt_buf)
- length = read_fm_event(hci, evt_buf, sizeof(struct fm_event_header_t) + MAX_FM_EVT_PARAMS);
+ if (!evt_buf) {
+ ALOGE("%s: Memory allocation failed for evt_buf", __func__);
+ goto cleanup;
+ }
+ length = read_fm_event(hci, evt_buf, sizeof(struct fm_event_header_t) + MAX_FM_EVT_PARAMS);
ALOGD("length=%d\n",length);
if(length <=0) {
lib_running =0;
}
+ goto exit;
+
+cleanup:
+ lib_running = 0;
+ hci = NULL;
+
+exit:
ALOGV("%s: Leaving hci_read_thread()", __func__);
+ if (evt_buf)
+ free(evt_buf);
pthread_exit(NULL);
return arg;
}
diff --git a/helium/radio_helium_hal.c b/helium/radio_helium_hal.c
index a45fd48..4d02987 100644
--- a/helium/radio_helium_hal.c
+++ b/helium/radio_helium_hal.c
@@ -641,8 +641,11 @@ static inline void hci_ev_radio_text(char *buff)
while ((buff[len+RDS_OFFSET] != 0x0d) && (len < MAX_RT_LENGTH))
len++;
+ if (len == 0)
+ return;
+
ALOGV("%s:%s: radio text length=%d\n", LOG_TAG, __func__,len);
- data = malloc(len+RDS_OFFSET);
+ data = malloc(len+RDS_OFFSET+1);
if (!data) {
ALOGE("%s:Failed to allocate memory", LOG_TAG);
return;
@@ -654,11 +657,9 @@ static inline void hci_ev_radio_text(char *buff)
data[3] = buff[RDS_PID_HIGHER];
data[4] = buff[RT_A_B_FLAG_OFFSET];
- if (len > 0) {
- memcpy(data+RDS_OFFSET, &buff[RDS_OFFSET], len);
- data[len+RDS_OFFSET] = 0x00;
- }
+ memcpy(data+RDS_OFFSET, &buff[RDS_OFFSET], len);
+ data[len+RDS_OFFSET] = 0x00;
hal->jni_cb->rt_update_cb(data);
free(data);
}
--
GitLab