android/AVRCP: Fix possible invalid read
Like in A2DP case it is not safe to call g_slist_remove within
g_slist_free_full callback.
diff --git a/android/avrcp.c b/android/avrcp.c
index f61ed34..7ee5a8a 100644
--- a/android/avrcp.c
+++ b/android/avrcp.c
@@ -140,10 +140,15 @@
g_io_channel_unref(dev->io);
}
- devices = g_slist_remove(devices, dev);
g_free(dev);
}
+static void avrcp_device_remove(struct avrcp_device *dev)
+{
+ devices = g_slist_remove(devices, dev);
+ avrcp_device_free(dev);
+}
+
static struct avrcp_device *avrcp_device_new(const bdaddr_t *dst)
{
struct avrcp_device *dev;
@@ -171,7 +176,7 @@
dev->session = NULL;
- avrcp_device_free(dev);
+ avrcp_device_remove(dev);
}
static void connect_cb(GIOChannel *chan, GError *err, gpointer user_data)
@@ -362,5 +367,5 @@
return;
}
- avrcp_device_free(dev);
+ avrcp_device_remove(dev);
}
