linux-bluetooth.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [Bluez-devel] Bug: infinite loop in extract_seq() when sdp_extract_seqtype() fails
@ 2006-06-16 23:01 Jason Watts
  2006-06-17 10:07 ` Marcel Holtmann
  0 siblings, 1 reply; 7+ messages in thread
From: Jason Watts @ 2006-06-16 23:01 UTC (permalink / raw)
  To: BlueZ

Hi,

I'm new to this list.  Please let me know if there is a more  
appropriate place to report this.

It appears that extract_seq() in sdp.c (bluez-libs) can enter an  
infinite loop if sdp_extract_seqtype() fails when extract_seq() has  
called itself recursively.  Here's how:

  1  static sdp_data_t *extract_seq(const void *p, int *len,  
sdp_record_t *rec)
  2  {
  3    int seqlen, n = 0;
  4    sdp_data_t *curr, *prev;
  5    sdp_data_t *d = (sdp_data_t *)malloc(sizeof(sdp_data_t));
  6
  7    SDPDBG("Extracting SEQ");
  8    memset(d, 0, sizeof(sdp_data_t));
  9    *len = sdp_extract_seqtype(p, &d->dtd, &seqlen);
10    SDPDBG("Sequence Type : 0x%x length : 0x%x\n", d->dtd, seqlen);
11
12    if (*len == 0)
13      return d;
14
15    p += *len;
16    curr = prev = NULL;
17    while (n < seqlen) {
18      int attrlen = 0;
19      curr = sdp_extract_attr(p, &attrlen, rec);
20      if (curr == NULL)
21        break;
22
23      if (prev)
24        prev->next = curr;
25      else
26        d->val.dataseq = curr;
27      prev = curr;
28      p += attrlen;
29      n += attrlen;
30
31      SDPDBG("Extracted: %d SequenceLength: %d", n, seqlen);
32    }
33
34    *len += n;
35    return d;
36  }


On line 9, sdp_extract_seqtype() will return zero if it does not  
recognize the sequence type.  When this happens, extract_seq() will  
set the output argument len to zero and return a pointer on line 13.   
Note that it will NOT return NULL.  It returns the chunk allocated on  
line 5.

Now, the while loop calls sdp_extract_attr() on line 19.  This call  
sets attrlen.  The loop will not advance if attrlen remains zero.   
sdp_extract_attr() function can in turn call extract_seq() again  
recursively.  When that happens here, the call to sdp_extract_attr()  
is equivalent to calling extract_seq() directly.

The loop would break on line 21 if sdp_extract_attr() returned NULL.   
But sdp_extract_attr() never returns NULL if it calls extract_seq(),  
because extract_seq() never returns NULL.

Thus, if sdp_extract_attr() calls extract_seq(), and then the  
sdp_extract_seqtype() call fails, then the loop will not break,  
because sdp_extract_attr() will return non-NULL, and the loop will  
not advance because attrlen will be zero.


Jason Watts
Embedded Software Engineer
Qwikker, Inc.



_______________________________________________
Bluez-devel mailing list
Bluez-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bluez-devel

^ permalink raw reply	[flat|nested] 7+ messages in thread
end of thread, other threads:[~2006-07-11 22:46 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2006-06-16 23:01 [Bluez-devel] Bug: infinite loop in extract_seq() when sdp_extract_seqtype() fails Jason Watts
2006-06-17 10:07 ` Marcel Holtmann
2006-06-19 18:08   ` Jason Watts
2006-06-19 18:27     ` Marcel Holtmann
2006-06-20  7:37       ` Pedro Monjo Florit
2006-06-20 19:54         ` Jason Watts
2006-07-11 22:46           ` Jason Watts

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).