* [PATCH BlueZ] media: fix wrong argument to lp_get_uid() in avrcp-player
@ 2026-08-15 21:04 Pauli Virtanen
2026-08-15 22:04 ` [BlueZ] " bluez.test.bot
0 siblings, 1 reply; 2+ messages in thread
From: Pauli Virtanen @ 2026-08-15 21:04 UTC (permalink / raw)
To: linux-bluetooth; +Cc: Pauli Virtanen
In track_changed(), lp_get_uid() is passed struct local_player although
player_link is expected, which is ASAN crash. It takes void * since
it's avrcp_player_cb callback function, so wasn't caught by compiler.
Pass the right object. Fixes AddressSanitizer: heap-buffer-overflow
---
profiles/audio/avrcp-player.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/profiles/audio/avrcp-player.c b/profiles/audio/avrcp-player.c
index d335e7ef6..43db0dc45 100644
--- a/profiles/audio/avrcp-player.c
+++ b/profiles/audio/avrcp-player.c
@@ -198,7 +198,7 @@ static void track_position(uint32_t old, uint32_t position, void *user_data)
static void track_changed(void *user_data)
{
struct player_link *p = user_data;
- uint64_t uid = lp_get_uid(p->lp);
+ uint64_t uid = lp_get_uid(p);
avrcp_player_event(p->avrcp, AVRCP_EVENT_TRACK_CHANGED, &uid);
avrcp_player_event(p->avrcp, AVRCP_EVENT_TRACK_REACHED_START, NULL);
--
2.55.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-08-15 22:04 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-15 21:04 [PATCH BlueZ] media: fix wrong argument to lp_get_uid() in avrcp-player Pauli Virtanen
2026-08-15 22:04 ` [BlueZ] " bluez.test.bot
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.