[PATCH] Fix potential bug in le_advertising_report()

[PATCH] Fix potential bug in le_advertising_report()

[Andre Guedes]

In the current implementation of le_advertising_report(), the variable
'info' has an invalid memory address after the 'for' loop. If 'info'
is dereferenced it will access invalid memory.

This patch fixes this potential bug and improves the code's readability.
---
 plugins/hciops.c |   15 ++++++++++-----
 1 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/plugins/hciops.c b/plugins/hciops.c
index c3d6290..fd19ef4 100644
--- a/plugins/hciops.c
+++ b/plugins/hciops.c
@@ -2184,14 +2184,19 @@ static inline void le_advertising_report(int index, evt_le_meta_event *meta)
 {
 	struct dev_info *dev = &devs[index];
 	le_advertising_info *info;
-	uint8_t num, i;
+	uint8_t num_reports;
+	const uint8_t RSSI_SIZE = 1;
 
-	num = meta->data[0];
-	info = (le_advertising_info *) (meta->data + 1);
+	num_reports = meta->data[0];
 
-	for (i = 0; i < num; i++) {
+	info = (le_advertising_info *) &meta->data[1];
+	btd_event_advertising_report(&dev->bdaddr, info);
+	num_reports--;
+
+	while (num_reports--) {
+		info = (le_advertising_info *) (info->data + info->length +
+								RSSI_SIZE);
 		btd_event_advertising_report(&dev->bdaddr, info);
-		info = (le_advertising_info *) (info->data + info->length + 1);
 	}
 }
 
-- 
1.7.1

Re: [PATCH] Fix potential bug in le_advertising_report()

[Johan Hedberg]

Hi André,

On Tue, Feb 22, 2011, Andre Guedes wrote:
> In the current implementation of le_advertising_report(), the variable
> 'info' has an invalid memory address after the 'for' loop. If 'info'
> is dereferenced it will access invalid memory.
> 
> This patch fixes this potential bug and improves the code's readability.
> ---
>  plugins/hciops.c |   15 ++++++++++-----
>  1 files changed, 10 insertions(+), 5 deletions(-)

The patch has been pushed upstream. Thanks.

Johan