[Qemu-devel] [PULL 19/20] l2cap: fix access to freed memory

[Michael Tokarev]

From: zhanghailiang <address@hidden>

Pointer 'ch' will be used in function 'l2cap_channel_open_req_msg' after
it was previously freed in 'l2cap_channel_open'.
Assigned it to NULL after it is freed.

Reviewed-by: Alex Bennée <address@hidden>
Reviewed-by: Michael S. Tsirkin <address@hidden>
Signed-off-by: zhanghailiang <address@hidden>
Signed-off-by: Michael Tokarev <address@hidden>
---
 hw/bt/l2cap.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/bt/l2cap.c b/hw/bt/l2cap.c
index 2301d6f..591e047 100644
--- a/hw/bt/l2cap.c
+++ b/hw/bt/l2cap.c
@@ -429,7 +429,7 @@ static struct l2cap_chan_s *l2cap_channel_open(struct 
l2cap_instance_s *l2cap,
                 status = L2CAP_CS_NO_INFO;
             } else {
                 g_free(ch);
-
+                ch = NULL;
                 result = L2CAP_CR_NO_MEM;
                 status = L2CAP_CS_NO_INFO;
             }
-- 
1.7.10.4