commit 1f19de06e2523356ae3ae909a1e14ab157591adb
author Smriti Gupta <smritig@codeaurora.org> Sat Jul 30 16:40:55 2016 +0530
committer Smriti Gupta <smritig@codeaurora.org> Tue Aug 02 15:22:38 2016 +0530
tree 5f0d971308e2e51ef254df2f7933a38dae4b2bbc
parent ca24ce0bf847d48b78479d957aa9bf2b373257cf

FM: Fix KW issues found in FM

Fix KW issues found in FM.

CRs-Fixed: 1048393
Change-Id: I1e47753f96307005ebe1a90254fe885295c04669

fm_hci/fm_hci.c

diff --git a/fm_hci/fm_hci.c b/fm_hci/fm_hci.c
index 74c0ac9..8c6173a 100644
--- a/fm_hci/fm_hci.c
+++ b/fm_hci/fm_hci.c
@@ -273,14 +273,26 @@
 
     struct fm_event_header_t *evt_buf = (struct fm_event_header_t *) malloc(sizeof(struct fm_event_header_t) + MAX_FM_EVT_PARAMS);
 
-    if (!evt_buf)
-        length = read_fm_event(hci, evt_buf, sizeof(struct fm_event_header_t) + MAX_FM_EVT_PARAMS);
+    if (!evt_buf) {
+        ALOGE("%s: Memory allocation failed for evt_buf", __func__);
+        goto cleanup;
+    }
 
+    length = read_fm_event(hci, evt_buf, sizeof(struct fm_event_header_t) + MAX_FM_EVT_PARAMS);
     ALOGD("length=%d\n",length);
     if(length <=0) {
        lib_running =0;
     }
+    goto exit;
+
+cleanup:
+    lib_running = 0;
+    hci = NULL;
+
+exit:
     ALOGV("%s: Leaving hci_read_thread()", __func__);
+    if (evt_buf)
+        free(evt_buf);
     pthread_exit(NULL);
     return arg;
 }

helium/radio_helium_hal.c

diff --git a/helium/radio_helium_hal.c b/helium/radio_helium_hal.c
index a45fd48..4d02987 100644
--- a/helium/radio_helium_hal.c
+++ b/helium/radio_helium_hal.c
@@ -641,8 +641,11 @@
 
     while ((buff[len+RDS_OFFSET] != 0x0d) && (len < MAX_RT_LENGTH))
            len++;
+    if (len == 0)
+        return;
+
     ALOGV("%s:%s: radio text length=%d\n", LOG_TAG, __func__,len);
-    data = malloc(len+RDS_OFFSET);
+    data = malloc(len+RDS_OFFSET+1);
     if (!data) {
         ALOGE("%s:Failed to allocate memory", LOG_TAG);
         return;
@@ -654,11 +657,9 @@
     data[3] = buff[RDS_PID_HIGHER];
     data[4] = buff[RT_A_B_FLAG_OFFSET];
 
-    if (len > 0) {
-        memcpy(data+RDS_OFFSET, &buff[RDS_OFFSET], len);
-        data[len+RDS_OFFSET] = 0x00;
-    }
+    memcpy(data+RDS_OFFSET, &buff[RDS_OFFSET], len);
 
+    data[len+RDS_OFFSET] = 0x00;
     hal->jni_cb->rt_update_cb(data);
     free(data);
 }