commit 5eb422ae9303807d28c461adc91230446da8db58
author Phaneendra Reddy <quic_phaneend@quicinc.com> Tue Jan 10 10:56:09 2023 +0530
committer Phaneendra Reddy <quic_phaneend@quicinc.com> Fri Jul 14 11:12:21 2023 +0530
tree 519b7eb0b0829d4760bb81d8a66ea426bd11255f
parent 145487de8a866ba05ad2e43bcddbff48419bcca7

FM: Corrected use-After Free memory access.

Removed the code which is causing
the use after free memory access in fm module

CRs-Fixed: 3373058
Change-Id: I56863c500c56ac8588f657fb87bbd74704720cc4

fm_hci/fm_hci.cpp

diff --git a/fm_hci/fm_hci.cpp b/fm_hci/fm_hci.cpp
index 0869afc..c08b884 100644
--- a/fm_hci/fm_hci.cpp
+++ b/fm_hci/fm_hci.cpp
@@ -573,9 +573,10 @@
             struct fm_event_header_t *temp = (struct fm_event_header_t *) malloc(event.size());
             if (temp != nullptr) {
                 memcpy(temp, event.data(), event.size());
-                ALOGI("%s: evt_code:  0x%x", __func__, temp->evt_code);
+                uint8_t evt = temp->evt_code;
+                ALOGI("%s: evt_code:  0x%x", __func__, evt);
                 enqueue_fm_rx_event(temp);
-                ALOGI("%s: evt_code:  0x%x done", __func__, temp->evt_code);
+                ALOGI("%s: evt_code:  0x%x done", __func__, evt);
             } else {
                 ALOGE("%s: Memory Allocation failed for event buffer ",__func__);
             }