Merge "FM: Fix KW issues found in FM" into fm.lnx.2.0.4-rel

fm_hci/fm_hci.c

@@ -273,14 +273,26 @@ static void *hci_read_thread(void *arg)
 
     struct fm_event_header_t *evt_buf = (struct fm_event_header_t *) malloc(sizeof(struct fm_event_header_t) + MAX_FM_EVT_PARAMS);
 
-    if (!evt_buf)
-        length = read_fm_event(hci, evt_buf, sizeof(struct fm_event_header_t) + MAX_FM_EVT_PARAMS);
+    if (!evt_buf) {
+        ALOGE("%s: Memory allocation failed for evt_buf", __func__);
+        goto cleanup;
+    }
 
+    length = read_fm_event(hci, evt_buf, sizeof(struct fm_event_header_t) + MAX_FM_EVT_PARAMS);
     ALOGD("length=%d\n",length);
     if(length <=0) {
        lib_running =0;
     }
+    goto exit;
+
+cleanup:
+    lib_running = 0;
+    hci = NULL;
+
+exit:
     ALOGV("%s: Leaving hci_read_thread()", __func__);
+    if (evt_buf)
+        free(evt_buf);
     pthread_exit(NULL);
     return arg;
 }

helium/radio_helium_hal.c

@@ -641,8 +641,11 @@ static inline void hci_ev_radio_text(char *buff)
 
     while ((buff[len+RDS_OFFSET] != 0x0d) && (len < MAX_RT_LENGTH))
            len++;
+    if (len == 0)
+        return;
+
     ALOGV("%s:%s: radio text length=%d\n", LOG_TAG, __func__,len);
-    data = malloc(len+RDS_OFFSET);
+    data = malloc(len+RDS_OFFSET+1);
     if (!data) {
         ALOGE("%s:Failed to allocate memory", LOG_TAG);
         return;
@@ -654,11 +657,9 @@ static inline void hci_ev_radio_text(char *buff)
     data[3] = buff[RDS_PID_HIGHER];
     data[4] = buff[RT_A_B_FLAG_OFFSET];
 
-    if (len > 0) {
-        memcpy(data+RDS_OFFSET, &buff[RDS_OFFSET], len);
-        data[len+RDS_OFFSET] = 0x00;
-    }
+    memcpy(data+RDS_OFFSET, &buff[RDS_OFFSET], len);
 
+    data[len+RDS_OFFSET] = 0x00;
     hal->jni_cb->rt_update_cb(data);
     free(data);
 }