* [PATCH BlueZ] advertising: Fix crash when if client invalidate property
@ 2018-01-19 13:37 Luiz Augusto von Dentz
2018-03-06 8:53 ` Luiz Augusto von Dentz
0 siblings, 1 reply; 2+ messages in thread
From: Luiz Augusto von Dentz @ 2018-01-19 13:37 UTC (permalink / raw)
To: linux-bluetooth
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
If a property is invalidated the iter is set to NULL which should be
checked and properly reset.
---
src/advertising.c | 54 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 54 insertions(+)
diff --git a/src/advertising.c b/src/advertising.c
index 94a8c4050..f00db86bd 100644
--- a/src/advertising.c
+++ b/src/advertising.c
@@ -203,6 +203,9 @@ static bool parse_type(DBusMessageIter *iter, struct btd_adv_client *client)
{
const char *msg_type;
+ if (!iter)
+ return true;
+
if (dbus_message_iter_get_arg_type(iter) != DBUS_TYPE_STRING)
return false;
@@ -226,6 +229,11 @@ static bool parse_service_uuids(DBusMessageIter *iter,
{
DBusMessageIter ariter;
+ if (!iter) {
+ bt_ad_clear_service_uuid(client->data);
+ return true;
+ }
+
if (dbus_message_iter_get_arg_type(iter) != DBUS_TYPE_ARRAY)
return false;
@@ -262,6 +270,11 @@ static bool parse_solicit_uuids(DBusMessageIter *iter,
{
DBusMessageIter ariter;
+ if (!iter) {
+ bt_ad_clear_solicit_uuid(client->data);
+ return true;
+ }
+
if (dbus_message_iter_get_arg_type(iter) != DBUS_TYPE_ARRAY)
return false;
@@ -298,6 +311,11 @@ static bool parse_manufacturer_data(DBusMessageIter *iter,
{
DBusMessageIter entries;
+ if (!iter) {
+ bt_ad_clear_manufacturer_data(client->data);
+ return true;
+ }
+
if (dbus_message_iter_get_arg_type(iter) != DBUS_TYPE_ARRAY)
return false;
@@ -353,6 +371,11 @@ static bool parse_service_data(DBusMessageIter *iter,
{
DBusMessageIter entries;
+ if (!iter) {
+ bt_ad_clear_service_data(client->data);
+ return true;
+ }
+
if (dbus_message_iter_get_arg_type(iter) != DBUS_TYPE_ARRAY)
return false;
@@ -422,11 +445,19 @@ static bool parse_includes(DBusMessageIter *iter,
{
DBusMessageIter entries;
+ if (!iter) {
+ client->flags = 0;
+ return true;
+ }
+
if (dbus_message_iter_get_arg_type(iter) != DBUS_TYPE_ARRAY)
return false;
dbus_message_iter_recurse(iter, &entries);
+ /* Reset flags before parsing */
+ client->flags = 0;
+
while (dbus_message_iter_get_arg_type(&entries) == DBUS_TYPE_STRING) {
const char *str;
struct adv_include *inc;
@@ -456,6 +487,12 @@ static bool parse_local_name(DBusMessageIter *iter,
{
const char *name;
+ if (!iter) {
+ free(client->name);
+ client->name = NULL;
+ return true;
+ }
+
if (dbus_message_iter_get_arg_type(iter) != DBUS_TYPE_STRING)
return false;
@@ -475,6 +512,11 @@ static bool parse_local_name(DBusMessageIter *iter,
static bool parse_appearance(DBusMessageIter *iter,
struct btd_adv_client *client)
{
+ if (!iter) {
+ client->appearance = 0;
+ return true;
+ }
+
if (dbus_message_iter_get_arg_type(iter) != DBUS_TYPE_UINT16)
return false;
@@ -491,6 +533,11 @@ static bool parse_appearance(DBusMessageIter *iter,
static bool parse_duration(DBusMessageIter *iter,
struct btd_adv_client *client)
{
+ if (!iter) {
+ client->duration = 0;
+ return true;
+ }
+
if (dbus_message_iter_get_arg_type(iter) != DBUS_TYPE_UINT16)
return false;
@@ -516,6 +563,13 @@ static gboolean client_timeout(void *user_data)
static bool parse_timeout(DBusMessageIter *iter,
struct btd_adv_client *client)
{
+ if (!iter) {
+ client->timeout = 0;
+ g_source_remove(client->to_id);
+ client->to_id = 0;
+ return true;
+ }
+
if (dbus_message_iter_get_arg_type(iter) != DBUS_TYPE_UINT16)
return false;
--
2.14.3
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH BlueZ] advertising: Fix crash when if client invalidate property
2018-01-19 13:37 [PATCH BlueZ] advertising: Fix crash when if client invalidate property Luiz Augusto von Dentz
@ 2018-03-06 8:53 ` Luiz Augusto von Dentz
0 siblings, 0 replies; 2+ messages in thread
From: Luiz Augusto von Dentz @ 2018-03-06 8:53 UTC (permalink / raw)
To: linux-bluetooth
Hi,
On Fri, Jan 19, 2018 at 3:37 PM, Luiz Augusto von Dentz
<luiz.dentz@gmail.com> wrote:
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
>
> If a property is invalidated the iter is set to NULL which should be
> checked and properly reset.
> ---
> src/advertising.c | 54 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
> 1 file changed, 54 insertions(+)
>
> diff --git a/src/advertising.c b/src/advertising.c
> index 94a8c4050..f00db86bd 100644
> --- a/src/advertising.c
> +++ b/src/advertising.c
> @@ -203,6 +203,9 @@ static bool parse_type(DBusMessageIter *iter, struct btd_adv_client *client)
> {
> const char *msg_type;
>
> + if (!iter)
> + return true;
> +
> if (dbus_message_iter_get_arg_type(iter) != DBUS_TYPE_STRING)
> return false;
>
> @@ -226,6 +229,11 @@ static bool parse_service_uuids(DBusMessageIter *iter,
> {
> DBusMessageIter ariter;
>
> + if (!iter) {
> + bt_ad_clear_service_uuid(client->data);
> + return true;
> + }
> +
> if (dbus_message_iter_get_arg_type(iter) != DBUS_TYPE_ARRAY)
> return false;
>
> @@ -262,6 +270,11 @@ static bool parse_solicit_uuids(DBusMessageIter *iter,
> {
> DBusMessageIter ariter;
>
> + if (!iter) {
> + bt_ad_clear_solicit_uuid(client->data);
> + return true;
> + }
> +
> if (dbus_message_iter_get_arg_type(iter) != DBUS_TYPE_ARRAY)
> return false;
>
> @@ -298,6 +311,11 @@ static bool parse_manufacturer_data(DBusMessageIter *iter,
> {
> DBusMessageIter entries;
>
> + if (!iter) {
> + bt_ad_clear_manufacturer_data(client->data);
> + return true;
> + }
> +
> if (dbus_message_iter_get_arg_type(iter) != DBUS_TYPE_ARRAY)
> return false;
>
> @@ -353,6 +371,11 @@ static bool parse_service_data(DBusMessageIter *iter,
> {
> DBusMessageIter entries;
>
> + if (!iter) {
> + bt_ad_clear_service_data(client->data);
> + return true;
> + }
> +
> if (dbus_message_iter_get_arg_type(iter) != DBUS_TYPE_ARRAY)
> return false;
>
> @@ -422,11 +445,19 @@ static bool parse_includes(DBusMessageIter *iter,
> {
> DBusMessageIter entries;
>
> + if (!iter) {
> + client->flags = 0;
> + return true;
> + }
> +
> if (dbus_message_iter_get_arg_type(iter) != DBUS_TYPE_ARRAY)
> return false;
>
> dbus_message_iter_recurse(iter, &entries);
>
> + /* Reset flags before parsing */
> + client->flags = 0;
> +
> while (dbus_message_iter_get_arg_type(&entries) == DBUS_TYPE_STRING) {
> const char *str;
> struct adv_include *inc;
> @@ -456,6 +487,12 @@ static bool parse_local_name(DBusMessageIter *iter,
> {
> const char *name;
>
> + if (!iter) {
> + free(client->name);
> + client->name = NULL;
> + return true;
> + }
> +
> if (dbus_message_iter_get_arg_type(iter) != DBUS_TYPE_STRING)
> return false;
>
> @@ -475,6 +512,11 @@ static bool parse_local_name(DBusMessageIter *iter,
> static bool parse_appearance(DBusMessageIter *iter,
> struct btd_adv_client *client)
> {
> + if (!iter) {
> + client->appearance = 0;
> + return true;
> + }
> +
> if (dbus_message_iter_get_arg_type(iter) != DBUS_TYPE_UINT16)
> return false;
>
> @@ -491,6 +533,11 @@ static bool parse_appearance(DBusMessageIter *iter,
> static bool parse_duration(DBusMessageIter *iter,
> struct btd_adv_client *client)
> {
> + if (!iter) {
> + client->duration = 0;
> + return true;
> + }
> +
> if (dbus_message_iter_get_arg_type(iter) != DBUS_TYPE_UINT16)
> return false;
>
> @@ -516,6 +563,13 @@ static gboolean client_timeout(void *user_data)
> static bool parse_timeout(DBusMessageIter *iter,
> struct btd_adv_client *client)
> {
> + if (!iter) {
> + client->timeout = 0;
> + g_source_remove(client->to_id);
> + client->to_id = 0;
> + return true;
> + }
> +
> if (dbus_message_iter_get_arg_type(iter) != DBUS_TYPE_UINT16)
> return false;
>
> --
> 2.14.3
Applied.
--
Luiz Augusto von Dentz
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2018-03-06 8:53 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-01-19 13:37 [PATCH BlueZ] advertising: Fix crash when if client invalidate property Luiz Augusto von Dentz
2018-03-06 8:53 ` Luiz Augusto von Dentz
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.