The current implementations for BluetoothRemoteGattServiceBlueZ and BluetoothRemoteGattCharacteristicBlueZ contain maps to the characteristics and descriptors they contain. It seems that the characteristics/descriptors being pointed to in these maps may be getting leaked.

For example,
a.) A descriptor gets discovered on a remote device, the characteristic object gets a call to GattDescriptorAdded. This adds an entry to the descriptors_ map with a newly created BluetoothGattDescriptorBlueZ object.
b.) This descriptor is removed by the remote device, so a GattDescriptorRemoved call gets invoked on the characteristic object. This causes us to remove the entry in the map for the BluetoothGattDescriptorBlueZ object, but we don't delete the object. Instead the object is forwarded to the BluetoothAdapter::Observer::GattDescriptorRemoved function.

As far as I can see, this observer function, in all its implementations, doesn't delete this descriptor object either.


To be fair, this is a very unlikely situation to happen, since this will almost always happen when a remote device is removing a service. It is unlikely that it will that it will just remove one characteristic for a service or or one descriptor from a characteristic. This can happen though and this should be fixed.