All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH BlueZ] media: fix wrong argument to lp_get_uid() in avrcp-player
@ 2026-08-15 21:04 Pauli Virtanen
  2026-08-15 22:04 ` [BlueZ] " bluez.test.bot
  0 siblings, 1 reply; 2+ messages in thread
From: Pauli Virtanen @ 2026-08-15 21:04 UTC (permalink / raw)
  To: linux-bluetooth; +Cc: Pauli Virtanen

In track_changed(), lp_get_uid() is passed struct local_player although
player_link is expected, which is ASAN crash.  It takes void * since
it's avrcp_player_cb callback function, so wasn't caught by compiler.

Pass the right object. Fixes AddressSanitizer: heap-buffer-overflow
---
 profiles/audio/avrcp-player.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/profiles/audio/avrcp-player.c b/profiles/audio/avrcp-player.c
index d335e7ef6..43db0dc45 100644
--- a/profiles/audio/avrcp-player.c
+++ b/profiles/audio/avrcp-player.c
@@ -198,7 +198,7 @@ static void track_position(uint32_t old, uint32_t position, void *user_data)
 static void track_changed(void *user_data)
 {
 	struct player_link *p = user_data;
-	uint64_t uid = lp_get_uid(p->lp);
+	uint64_t uid = lp_get_uid(p);
 
 	avrcp_player_event(p->avrcp, AVRCP_EVENT_TRACK_CHANGED, &uid);
 	avrcp_player_event(p->avrcp, AVRCP_EVENT_TRACK_REACHED_START, NULL);
-- 
2.55.0


^ permalink raw reply related	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2026-08-15 22:04 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-15 21:04 [PATCH BlueZ] media: fix wrong argument to lp_get_uid() in avrcp-player Pauli Virtanen
2026-08-15 22:04 ` [BlueZ] " bluez.test.bot

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.