已合并
fix ble broadcast memory leak #11185
wangJE创建于 2025年10月29日
fix ble broadcast memory leak #11185
已合并
共 2 个文件变更+14-7
| @@ -13,6 +13,7 @@ | |||
| 13 | * limitations under the License. | 13 | * limitations under the License. |
| 14 | */ | 14 | */ |
| 15 | 15 | ||
| 16 | +#include "securec.h" | ||
| 16 | #include <stdatomic.h> | 17 | #include <stdatomic.h> |
| 17 | #include <string.h> | 18 | #include <string.h> |
| 18 | 19 | ||
| @@ -343,11 +344,13 @@ static void WrapperScanResultCb(uint8_t channelId, BtScanResultData *data) | |||
| 343 | return; | 344 | return; |
| 344 | } | 345 | } |
| 345 | SoftBusBcScanResult scanResult = {}; | 346 | SoftBusBcScanResult scanResult = {}; |
| 347 | + (void)memset_s(&scanResult, sizeof(SoftBusBcScanResult), 0, sizeof(SoftBusBcScanResult)); | ||
| 346 | BtScanResultToSoftbus(data, &scanResult); | 348 | BtScanResultToSoftbus(data, &scanResult); |
| 347 | 349 | ||
| 348 | if (ParseScanResult(data->advData, data->advLen, &scanResult) != SOFTBUS_OK) { | 350 | if (ParseScanResult(data->advData, data->advLen, &scanResult) != SOFTBUS_OK) { |
| 349 | SoftBusFree(scanResult.data.bcData.payload); | 351 | SoftBusFree(scanResult.data.bcData.payload); |
| 350 | SoftBusFree(scanResult.data.rspData.payload); | 352 | SoftBusFree(scanResult.data.rspData.payload); |
| 353 | + SoftBusFree(scanResult.data.uuidData.payload); | ||
| 351 | SoftBusMutexUnlock(&g_scannerLock); | 354 | SoftBusMutexUnlock(&g_scannerLock); |
| 352 | return; | 355 | return; |
| 353 | } | 356 | } |
| @@ -355,6 +358,7 @@ static void WrapperScanResultCb(uint8_t channelId, BtScanResultData *data) | |||
| 355 | DISC_LOGE(DISC_BLE_ADAPTER, "scanner callback is null"); | 358 | DISC_LOGE(DISC_BLE_ADAPTER, "scanner callback is null"); |
| 356 | SoftBusFree(scanResult.data.bcData.payload); | 359 | SoftBusFree(scanResult.data.bcData.payload); |
| 357 | SoftBusFree(scanResult.data.rspData.payload); | 360 | SoftBusFree(scanResult.data.rspData.payload); |
| 361 | + SoftBusFree(scanResult.data.uuidData.payload); | ||
| 358 | SoftBusMutexUnlock(&g_scannerLock); | 362 | SoftBusMutexUnlock(&g_scannerLock); |
| 359 | return; | 363 | return; |
| 360 | } | 364 | } |
| @@ -372,6 +376,7 @@ static void WrapperScanResultCb(uint8_t channelId, BtScanResultData *data) | |||
| 372 | callback.OnReportScanDataCallback(BROADCAST_PROTOCOL_BLE, channelId, &scanResult); | 376 | callback.OnReportScanDataCallback(BROADCAST_PROTOCOL_BLE, channelId, &scanResult); |
| 373 | SoftBusFree(scanResult.data.bcData.payload); | 377 | SoftBusFree(scanResult.data.bcData.payload); |
| 374 | SoftBusFree(scanResult.data.rspData.payload); | 378 | SoftBusFree(scanResult.data.rspData.payload); |
| 379 | + SoftBusFree(scanResult.data.uuidData.payload); | ||
| 375 | } | 380 | } |
| 376 | 381 | ||
| 377 | static void WrapperScanStateChangeCb(uint8_t channelId, int32_t resultCode, bool isStartScan) | 382 | static void WrapperScanStateChangeCb(uint8_t channelId, int32_t resultCode, bool isStartScan) |
| @@ -487,20 +487,22 @@ static int32_t ParseLocalName(const uint8_t *advData, uint8_t advLen, SoftBusBcS | |||
| 487 | static int32_t ParsePayload( | 487 | static int32_t ParsePayload( |
| 488 | SoftbusBroadcastPayload *data, const uint8_t *advData, uint8_t advLen, uint8_t index, uint8_t len) | 488 | SoftbusBroadcastPayload *data, const uint8_t *advData, uint8_t advLen, uint8_t index, uint8_t len) |
| 489 | { | 489 | { |
| 490 | - data->payloadLen = (len < (ID_LEN + 1)) ? 0 : len - ID_LEN - 1; | 490 | + DISC_CHECK_AND_RETURN_RET_LOGE(advLen - index >= ID_LEN + 1, |
| 491 | + SOFTBUS_BC_ADAPTER_PARSE_FAIL, DISC_BLE_ADAPTER, "invalid advLen=%{public}u", advLen); | ||
| 492 | + DISC_CHECK_AND_RETURN_RET_LOGE(len >= ID_LEN + 1, | ||
| 493 | + SOFTBUS_BC_ADAPTER_PARSE_FAIL, DISC_BLE_ADAPTER, "invalid len=%{public}u", len); | ||
| 494 | + data->payloadLen = len - ID_LEN - 1; | ||
| 495 | + DISC_CHECK_AND_RETURN_RET_LOGE(data->payloadLen <= advLen - index - ID_LEN - 1, SOFTBUS_BC_ADAPTER_PARSE_FAIL, | ||
| 496 | + DISC_BLE_ADAPTER, "invalid payloadLen=%{public}u", data->payloadLen); | ||
| 497 | + data->type = BtAdvTypeToSoftbus(advData[index]); | ||
| 498 | + data->id = ((uint16_t)advData[index + ID_LEN] << BC_SHIFT_BIT) | (uint16_t)advData[index + ID_LEN - 1]; | ||
| 491 | if (data->payloadLen == 0) { | 499 | if (data->payloadLen == 0) { |
| 492 | DISC_LOGW(DISC_BLE_ADAPTER, "parse no payload"); | 500 | DISC_LOGW(DISC_BLE_ADAPTER, "parse no payload"); |
| 493 | return SOFTBUS_OK; | 501 | return SOFTBUS_OK; |
| 494 | } | 502 | } |
| 495 | - DISC_CHECK_AND_RETURN_RET_LOGE(data->payloadLen >= 0 && index + ID_LEN < advLen, | ||
| 496 | - SOFTBUS_BC_ADAPTER_PARSE_FAIL, DISC_BLE_ADAPTER, "parse payload failed"); | ||
| 497 | - data->type = BtAdvTypeToSoftbus(advData[index]); | ||
| 498 | - data->id = ((uint16_t)advData[index + ID_LEN] << BC_SHIFT_BIT) | (uint16_t)advData[index + ID_LEN - 1]; | ||
| 499 | data->payload = (uint8_t *)SoftBusCalloc(data->payloadLen); | 503 | data->payload = (uint8_t *)SoftBusCalloc(data->payloadLen); |
| 500 | DISC_CHECK_AND_RETURN_RET_LOGE(data->payload != NULL, SOFTBUS_MALLOC_ERR, DISC_BLE_ADAPTER, | 504 | DISC_CHECK_AND_RETURN_RET_LOGE(data->payload != NULL, SOFTBUS_MALLOC_ERR, DISC_BLE_ADAPTER, |
| 501 | "malloc payload failed"); | 505 | "malloc payload failed"); |
| 502 | - DISC_CHECK_AND_RETURN_RET_LOGE(index + ID_LEN + 1 < advLen, SOFTBUS_BC_ADAPTER_PARSE_FAIL, | ||
| 503 | - DISC_BLE_ADAPTER, "advLen is invalid"); | ||
| 504 | (void)memcpy_s(data->payload, data->payloadLen, &advData[index + ID_LEN + 1], data->payloadLen); | 506 | (void)memcpy_s(data->payload, data->payloadLen, &advData[index + ID_LEN + 1], data->payloadLen); |
| 505 | return SOFTBUS_OK; | 507 | return SOFTBUS_OK; |
| 506 | } | 508 | } |