[Bluez-devel] [Patch] Samsung D600 (sdp, service discovery deadlocks)

[Victor Shchebatyuk <victor@win.tue.nl>]

[-- Attachment #1: Type: text/plain, Size: 719 bytes --]

Hi Marcel,

We experienced some deadlock in the bluez library for Samsund-D600 phone
during service discovery. This is due to incorrect SDP record set
returned on service inquiry request. The response from the SDP server
contains service records + some rubbish at the end. So when it tries to
parse it, sdp_extract_pdu() returns 0 recsize and locks the while()
loop.
Samsung is informed, but I do not know if they will come up with
something (have no idea who provides the stack for them, they have a
Broadcom chip in there)

The patch is attached.

Regards,
    Victor.

P.S. I do not have the phone with me now, otherwise I would send in
hcidump output. It reports errors when trying to parse at the end of
response.

[-- Attachment #2: sdp-samsungd600.patch --]
[-- Type: text/x-patch, Size: 444 bytes --]

Index: src/sdp.c
===================================================================
RCS file: /cvsroot/bluez/libs/src/sdp.c,v
retrieving revision 1.30
diff -u -r1.30 sdp.c
--- src/sdp.c	29 Oct 2005 19:25:43 -0000	1.30
+++ src/sdp.c	22 Nov 2005 20:24:12 -0000
@@ -3115,6 +3115,10 @@
 					status = -1;
 					goto end;
 				}
+				if (!recsize) {
+					sdp_record_free(rec);
+					break;
+				}
 				scanned += recsize;
 				pdata += recsize;