Component/bt: fix memory leak in security server

diff --git a/components/bt/bluedroid/stack/gatt/gatt_cl.c b/components/bt/bluedroid/stack/gatt/gatt_cl.c
index ba0202007119a04066d6b524fe38402433cdfec9..daa911e8c2a5c318422e62720ffcc22e81d07b58 100644 (file)
--- a/components/bt/bluedroid/stack/gatt/gatt_cl.c
+++ b/components/bt/bluedroid/stack/gatt/gatt_cl.c
@@ -1038,7 +1038,10 @@ BOOLEAN gatt_cl_send_next_cmd_inq(tGATT_TCB *p_tcb)
         if (att_ret == GATT_SUCCESS || att_ret == GATT_CONGESTED) {
             sent = TRUE;
             p_cmd->to_send = FALSE;
-            p_cmd->p_cmd = NULL;
+            if(p_cmd->p_cmd) {
+                osi_free(p_cmd->p_cmd);
+                p_cmd->p_cmd = NULL;
+            }
 
             /* dequeue the request if is write command or sign write */
             if (p_cmd->op_code != GATT_CMD_WRITE && p_cmd->op_code != GATT_SIGN_CMD_WRITE) {

diff --git a/components/bt/bluedroid/stack/gatt/gatt_utils.c b/components/bt/bluedroid/stack/gatt/gatt_utils.c
index 12a2e1dba324db38180fccefdecb570d877792a9..5dd43a2fe78a476c9b00de8bd62a8417195df445 100644 (file)
--- a/components/bt/bluedroid/stack/gatt/gatt_utils.c
+++ b/components/bt/bluedroid/stack/gatt/gatt_utils.c
@@ -2258,6 +2258,7 @@ void gatt_cleanup_upon_disc(BD_ADDR bda, UINT16 reason, tBT_TRANSPORT transport)
         GATT_TRACE_DEBUG ("exit gatt_cleanup_upon_disc ");
         BTM_Recovery_Pre_State();
     }
+    gatt_delete_dev_from_srv_chg_clt_list(bda);
 }
 /*******************************************************************************
 **

diff --git a/components/bt/bluedroid/stack/smp/smp_l2c.c b/components/bt/bluedroid/stack/smp/smp_l2c.c
index 7c5efa7ea43303b64b40578433a3c509e7c7265d..a3ac356acaeae0c379ea42559c780ed85b91797e 100644 (file)
--- a/components/bt/bluedroid/stack/smp/smp_l2c.c
+++ b/components/bt/bluedroid/stack/smp/smp_l2c.c
@@ -105,7 +105,10 @@ static void smp_connect_callback (UINT16 channel, BD_ADDR bd_addr, BOOLEAN conne
     if (transport == BT_TRANSPORT_BR_EDR || memcmp(bd_addr, dummy_bda, BD_ADDR_LEN) == 0) {
         return;
     }
-
+    if(!connected && &p_cb->rsp_timer_ent) {
+        //free timer
+        btu_free_timer(&p_cb->rsp_timer_ent);      
+    }
     if (memcmp(bd_addr, p_cb->pairing_bda, BD_ADDR_LEN) == 0) {
         SMP_TRACE_EVENT ("%s()  for pairing BDA: %08x%04x  Event: %s\n",
                          __FUNCTION__,