[Bluez-devel] [Patch] Samsung D600 (sdp, service discovery deadlocks)

[Bluez-devel] [Patch] Samsung D600 (sdp, service discovery deadlocks)

[Victor Shchebatyuk]

[-- Attachment #1: Type: text/plain, Size: 719 bytes --]

Hi Marcel,

We experienced some deadlock in the bluez library for Samsund-D600 phone
during service discovery. This is due to incorrect SDP record set
returned on service inquiry request. The response from the SDP server
contains service records + some rubbish at the end. So when it tries to
parse it, sdp_extract_pdu() returns 0 recsize and locks the while()
loop.
Samsung is informed, but I do not know if they will come up with
something (have no idea who provides the stack for them, they have a
Broadcom chip in there)

The patch is attached.

Regards,
    Victor.

P.S. I do not have the phone with me now, otherwise I would send in
hcidump output. It reports errors when trying to parse at the end of
response.

[-- Attachment #2: sdp-samsungd600.patch --]
[-- Type: text/x-patch, Size: 444 bytes --]

Index: src/sdp.c
===================================================================
RCS file: /cvsroot/bluez/libs/src/sdp.c,v
retrieving revision 1.30
diff -u -r1.30 sdp.c
--- src/sdp.c	29 Oct 2005 19:25:43 -0000	1.30
+++ src/sdp.c	22 Nov 2005 20:24:12 -0000
@@ -3115,6 +3115,10 @@
 					status = -1;
 					goto end;
 				}
+				if (!recsize) {
+					sdp_record_free(rec);
+					break;
+				}
 				scanned += recsize;
 				pdata += recsize;
 

Re: [Bluez-devel] [Patch] Samsung D600 (sdp, service discovery deadlocks)

[Marcel Holtmann]

Hi Victor,

> We experienced some deadlock in the bluez library for Samsund-D600 phone
> during service discovery. This is due to incorrect SDP record set
> returned on service inquiry request. The response from the SDP server
> contains service records + some rubbish at the end. So when it tries to
> parse it, sdp_extract_pdu() returns 0 recsize and locks the while()
> loop.

the patch is in the CVS now. Thanks.

> Samsung is informed, but I do not know if they will come up with
> something (have no idea who provides the stack for them, they have a
> Broadcom chip in there)

Don't expect anything.

> P.S. I do not have the phone with me now, otherwise I would send in
> hcidump output. It reports errors when trying to parse at the end of
> response.

I like to have these phones at home for further testing, but getting all
the bad phones is quite an expensive hobby. The donations are not enough
to buy them.

Regards

Marcel




-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
Bluez-devel mailing list
Bluez-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bluez-devel