[PATCH BlueZ v2 0/3] fix errors found by SVACE static analyzer

[PATCH BlueZ v2 0/3] fix errors found by SVACE static analyzer

[Roman Smirnov]

Several bug fixes.

Roman Smirnov (3):
  shared/vcp: prevent dereferencing of NULL pointers
  client/player: fix the order of args in cmd_register_endpoint()
  shared/gatt-client: add NULL check to discover_secondary_cb()

 client/player.c          |  2 +-
 src/shared/gatt-client.c |  4 +++-
 src/shared/vcp.c         | 20 ++++----------------
 3 files changed, 8 insertions(+), 18 deletions(-)

-- 
2.43.0

[PATCH BlueZ v2 1/3] shared/vcp: prevent dereferencing of NULL pointers

[Roman Smirnov]

Using util_memdup() will terminate the program if memory
allocation fails.

Found with the SVACE static analysis tool.
---
 V1 -> V2: util_memdup() is used instead of checking for NULL
 src/shared/vcp.c | 20 ++++----------------
 1 file changed, 4 insertions(+), 16 deletions(-)

diff --git a/src/shared/vcp.c b/src/shared/vcp.c
index 06264a241..4597bebf6 100644
--- a/src/shared/vcp.c
+++ b/src/shared/vcp.c
@@ -2127,14 +2127,8 @@ static void read_vocs_audio_descriptor(struct bt_vcp *vcp, bool success,
 		return;
 	}
 
-	vocs_ao_dec_r = malloc(length+1);
-	memset(vocs_ao_dec_r, 0, length+1);
-	memcpy(vocs_ao_dec_r, value, length);
-
-	if (!vocs_ao_dec_r) {
-		DBG(vcp, "Unable to get VOCS Audio Descriptor");
-		return;
-	}
+	vocs_ao_dec_r = util_memdup(value, length + 1);
+	memset(vocs_ao_dec_r + length, 0, 1);
 
 	DBG(vcp, "VOCS Audio Descriptor: %s", vocs_ao_dec_r);
 	free(vocs_ao_dec_r);
@@ -2531,14 +2525,8 @@ static void read_aics_audio_ip_description(struct bt_vcp *vcp, bool success,
 		return;
 	}
 
-	ip_descrptn = malloc(length+1);
-	memset(ip_descrptn, 0, length+1);
-	memcpy(ip_descrptn, value, length);
-
-	if (!ip_descrptn) {
-		DBG(vcp, "Unable to get Audio Input Description");
-		return;
-	}
+	ip_descrptn = util_memdup(value, length + 1);
+	memset(ip_descrptn + length, 0, 1);
 
 	DBG(vcp, "Audio Input Description: %s", ip_descrptn);
 	free(ip_descrptn);
-- 
2.43.0

[PATCH BlueZ v2 2/3] client/player: fix the order of args in cmd_register_endpoint()

[Roman Smirnov]

Based on the function prototype, ep->cid and ep->vid should be swapped.

Found with the SVACE static analysis tool.
---
 V1 -> V2: the patch header is now shorter
 client/player.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/player.c b/client/player.c
index 0d031e4b0..2569b38e9 100644
--- a/client/player.c
+++ b/client/player.c
@@ -3388,7 +3388,7 @@ static void cmd_register_endpoint(int argc, char *argv[])
 
 	if (strrchr(argv[2], ':')) {
 		ep->codec = 0xff;
-		parse_vendor_codec(argv[2], &ep->cid, &ep->vid);
+		parse_vendor_codec(argv[2], &ep->vid, &ep->cid);
 		ep->preset = new0(struct preset, 1);
 		ep->preset->custom.name = strdup("custom");
 		ep->preset->default_preset = &ep->preset->custom;
-- 
2.43.0

[PATCH BlueZ v2 3/3] shared/gatt-client: add NULL check to discover_secondary_cb()

[Roman Smirnov]

It is necessary to prevent dereferencing of a NULL pointer.

Found with the SVACE static analysis tool.
---
 src/shared/gatt-client.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/shared/gatt-client.c b/src/shared/gatt-client.c
index 8e4ae7e5e..8b0362503 100644
--- a/src/shared/gatt-client.c
+++ b/src/shared/gatt-client.c
@@ -1276,7 +1276,9 @@ next:
 
 	range = queue_peek_head(op->discov_ranges);
 
-	client->discovery_req = bt_gatt_discover_included_services(client->att,
+	if (range)
+		client->discovery_req = bt_gatt_discover_included_services(
+							client->att,
 							range->start,
 							range->end,
 							discover_incl_cb,
-- 
2.43.0

RE: fix errors found by SVACE static analyzer

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 3081 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=868373

---Test result---

Test Summary:
CheckPatch                    PASS      0.77 seconds
GitLint                       PASS      0.59 seconds
BuildEll                      PASS      24.78 seconds
BluezMake                     PASS      1695.19 seconds
MakeCheck                     PASS      13.40 seconds
MakeDistcheck                 PASS      177.22 seconds
CheckValgrind                 PASS      252.90 seconds
CheckSmatch                   PASS      357.48 seconds
bluezmakeextell               PASS      120.68 seconds
IncrementalBuild              PASS      4657.50 seconds
ScanBuild                     WARNING   1080.72 seconds

Details
##############################
Test: ScanBuild - WARNING
Desc: Run Scan Build
Output:
src/shared/gatt-client.c:451:21: warning: Use of memory after it is freed
        gatt_db_unregister(op->client->db, op->db_id);
                           ^~~~~~~~~~
src/shared/gatt-client.c:696:2: warning: Use of memory after it is freed
        discovery_op_complete(op, false, att_ecode);
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:996:2: warning: Use of memory after it is freed
        discovery_op_complete(op, success, att_ecode);
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1102:2: warning: Use of memory after it is freed
        discovery_op_complete(op, success, att_ecode);
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1296:2: warning: Use of memory after it is freed
        discovery_op_complete(op, success, att_ecode);
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1361:2: warning: Use of memory after it is freed
        discovery_op_complete(op, success, att_ecode);
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1636:6: warning: Use of memory after it is freed
        if (read_db_hash(op)) {
            ^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1641:2: warning: Use of memory after it is freed
        discover_all(op);
        ^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:2145:6: warning: Use of memory after it is freed
        if (read_db_hash(op)) {
            ^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:2153:8: warning: Use of memory after it is freed
                                                        discovery_op_ref(op),
                                                        ^~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:3242:2: warning: Use of memory after it is freed
        complete_write_long_op(req, success, 0, false);
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:3264:2: warning: Use of memory after it is freed
        request_unref(req);
        ^~~~~~~~~~~~~~~~~~
12 warnings generated.



---
Regards,
Linux Bluetooth

Re: [PATCH BlueZ v2 0/3] fix errors found by SVACE static analyzer

[patchwork-bot+bluetooth]

Hello:

This series was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Thu, 4 Jul 2024 12:07:51 +0300 you wrote:
> Several bug fixes.
> 
> Roman Smirnov (3):
>   shared/vcp: prevent dereferencing of NULL pointers
>   client/player: fix the order of args in cmd_register_endpoint()
>   shared/gatt-client: add NULL check to discover_secondary_cb()
> 
> [...]

Here is the summary with links:
  - [BlueZ,v2,1/3] shared/vcp: prevent dereferencing of NULL pointers
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=7ffc08dd78d6
  - [BlueZ,v2,2/3] client/player: fix the order of args in cmd_register_endpoint()
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=cf3d80a01f1f
  - [BlueZ,v2,3/3] shared/gatt-client: add NULL check to discover_secondary_cb()
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=7a45038dc1e5

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html