Merge "Use after free in GATT TCB commands" into main

1 files changed, 3 insertions, 0 deletions

diff --git a/system/stack/gatt/gatt_utils.cc b/system/stack/gatt/gatt_utils.cc
index 7ff819a5e0..57f781db3f 100644
--- a/system/stack/gatt/gatt_utils.cc
+++ b/system/stack/gatt/gatt_utils.cc
@@ -1855,6 +1855,9 @@ void gatt_cleanup_upon_disc(const RawAddress& bda, tGATT_DISCONN_REASON reason,
   gatt_free_pending_ind(p_tcb);
   fixed_queue_free(p_tcb->sr_cmd.multi_rsp_q, NULL);
   p_tcb->sr_cmd.multi_rsp_q = NULL;
+  if (p_tcb->sr_cmd.p_rsp_msg) {
+    osi_free_and_reset((void**)&p_tcb->sr_cmd.p_rsp_msg);
+  }
 
   gatt_disconnect_complete_notify_user(bda, reason, transport);