[PATCH BlueZ] src/gatt-client: Fix iteration through options

[PATCH BlueZ] src/gatt-client: Fix iteration through options

[Tobias Svehagen]

Fix infinite loop when trying to read/write a characteristic or
a descriptor and the ReadValue/WriteValue call has at least one
option.
---
 src/gatt-client.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/gatt-client.c b/src/gatt-client.c
index 0cbacca..6fc0d19 100644
--- a/src/gatt-client.c
+++ b/src/gatt-client.c
@@ -401,6 +401,8 @@ static int parse_options(DBusMessageIter *iter, uint16_t *offset)
 				return -EINVAL;
 			dbus_message_iter_get_basic(&value, offset);
 		}
+
+		dbus_message_iter_next(&dict);
 	}
 
 	return 0;
-- 
2.8.3

[PATCH BlueZ 1/2] tools/gatt-service: Fix iteration through options

[Tobias Svehagen]

Fixes an infinite loop when trying to read a descriptor and the
ReadValue call has at least one option.
---
 tools/gatt-service.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tools/gatt-service.c b/tools/gatt-service.c
index 0c78c4d..1cf8b3c 100644
--- a/tools/gatt-service.c
+++ b/tools/gatt-service.c
@@ -407,6 +407,8 @@ static int parse_options(DBusMessageIter *iter, const char **device)
 			dbus_message_iter_get_basic(&value, device);
 			printf("Device: %s\n", *device);
 		}
+
+		dbus_message_iter_next(&dict);
 	}
 
 	return 0;
-- 
2.8.3

[PATCH BlueZ 2/2] tools/gatt-service: Do not call parse_options on reply message

[Tobias Svehagen]

A call to dbus_message_iter_get_arg_type will cause an assertion
since it is called on the wrong type of iterator.
---
 tools/gatt-service.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/tools/gatt-service.c b/tools/gatt-service.c
index 1cf8b3c..6bd5576 100644
--- a/tools/gatt-service.c
+++ b/tools/gatt-service.c
@@ -515,10 +515,6 @@ static DBusMessage *desc_read_value(DBusConnection *conn, DBusMessage *msg,
 
 	dbus_message_iter_init_append(reply, &iter);
 
-	if (parse_options(&iter, &device))
-		return g_dbus_create_error(msg, DBUS_ERROR_INVALID_ARGS,
-							"Invalid arguments");
-
 	desc_read(desc, &iter);
 
 	return reply;
-- 
2.8.3

Re: [PATCH BlueZ] src/gatt-client: Fix iteration through options

[Luiz Augusto von Dentz]

Hi Tobias,

On Thu, Jun 16, 2016 at 4:29 PM, Tobias Svehagen
<tobias.svehagen@gmail.com> wrote:
> Fix infinite loop when trying to read/write a characteristic or
> a descriptor and the ReadValue/WriteValue call has at least one
> option.
> ---
>  src/gatt-client.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/src/gatt-client.c b/src/gatt-client.c
> index 0cbacca..6fc0d19 100644
> --- a/src/gatt-client.c
> +++ b/src/gatt-client.c
> @@ -401,6 +401,8 @@ static int parse_options(DBusMessageIter *iter, uint16_t *offset)
>                                 return -EINVAL;
>                         dbus_message_iter_get_basic(&value, offset);
>                 }
> +
> +               dbus_message_iter_next(&dict);
>         }
>
>         return 0;
> --
> 2.8.3

Applied, thanks.

-- 
Luiz Augusto von Dentz

Re: [PATCH BlueZ 1/2] tools/gatt-service: Fix iteration through options

[Luiz Augusto von Dentz]

Hi Tobias,

On Thu, Jun 16, 2016 at 4:29 PM, Tobias Svehagen
<tobias.svehagen@gmail.com> wrote:
> Fixes an infinite loop when trying to read a descriptor and the
> ReadValue call has at least one option.
> ---
>  tools/gatt-service.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/tools/gatt-service.c b/tools/gatt-service.c
> index 0c78c4d..1cf8b3c 100644
> --- a/tools/gatt-service.c
> +++ b/tools/gatt-service.c
> @@ -407,6 +407,8 @@ static int parse_options(DBusMessageIter *iter, const char **device)
>                         dbus_message_iter_get_basic(&value, device);
>                         printf("Device: %s\n", *device);
>                 }
> +
> +               dbus_message_iter_next(&dict);
>         }
>
>         return 0;
> --
> 2.8.3

Applied, thanks.

-- 
Luiz Augusto von Dentz