* [PATCH BlueZ 1/5] health: Fix pointer to local variable out-of-scope
@ 2013-01-08 11:37 Syam Sidhardhan
2013-01-08 11:37 ` [PATCH BlueZ 2/5] health: Fix possible use after free Syam Sidhardhan
` (4 more replies)
0 siblings, 5 replies; 6+ messages in thread
From: Syam Sidhardhan @ 2013-01-08 11:37 UTC (permalink / raw)
To: linux-bluetooth
The address of the local variable is used outside the scope.
---
profiles/health/hdp_util.c | 12 ++++--------
1 file changed, 4 insertions(+), 8 deletions(-)
diff --git a/profiles/health/hdp_util.c b/profiles/health/hdp_util.c
index 5f81806..ed987e3 100644
--- a/profiles/health/hdp_util.c
+++ b/profiles/health/hdp_util.c
@@ -153,13 +153,12 @@ static gboolean parse_data_type(DBusMessageIter *iter, gpointer data,
{
struct hdp_application *app = data;
DBusMessageIter *value;
+ DBusMessageIter variant;
int ctype;
ctype = dbus_message_iter_get_arg_type(iter);
value = iter;
if (ctype == DBUS_TYPE_VARIANT) {
- DBusMessageIter variant;
-
/* Get value inside the variable */
dbus_message_iter_recurse(iter, &variant);
ctype = dbus_message_iter_get_arg_type(&variant);
@@ -181,13 +180,12 @@ static gboolean parse_role(DBusMessageIter *iter, gpointer data, GError **err)
{
struct hdp_application *app = data;
DBusMessageIter *string;
+ DBusMessageIter value;
int ctype;
const char *role;
ctype = dbus_message_iter_get_arg_type(iter);
if (ctype == DBUS_TYPE_VARIANT) {
- DBusMessageIter value;
-
/* Get value inside the variable */
dbus_message_iter_recurse(iter, &value);
ctype = dbus_message_iter_get_arg_type(&value);
@@ -222,13 +220,12 @@ static gboolean parse_desc(DBusMessageIter *iter, gpointer data, GError **err)
{
struct hdp_application *app = data;
DBusMessageIter *string;
+ DBusMessageIter variant;
int ctype;
const char *desc;
ctype = dbus_message_iter_get_arg_type(iter);
if (ctype == DBUS_TYPE_VARIANT) {
- DBusMessageIter variant;
-
/* Get value inside the variable */
dbus_message_iter_recurse(iter, &variant);
ctype = dbus_message_iter_get_arg_type(&variant);
@@ -253,14 +250,13 @@ static gboolean parse_chan_type(DBusMessageIter *iter, gpointer data,
{
struct hdp_application *app = data;
DBusMessageIter *value;
+ DBusMessageIter variant;
char *chan_type;
int ctype;
ctype = dbus_message_iter_get_arg_type(iter);
value = iter;
if (ctype == DBUS_TYPE_VARIANT) {
- DBusMessageIter variant;
-
/* Get value inside the variable */
dbus_message_iter_recurse(iter, &variant);
ctype = dbus_message_iter_get_arg_type(&variant);
--
1.7.9.5
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH BlueZ 2/5] health: Fix possible use after free
2013-01-08 11:37 [PATCH BlueZ 1/5] health: Fix pointer to local variable out-of-scope Syam Sidhardhan
@ 2013-01-08 11:37 ` Syam Sidhardhan
2013-01-08 11:37 ` [PATCH BlueZ 3/5] unit: Replace g_test_fail() with g_assert() Syam Sidhardhan
` (3 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Syam Sidhardhan @ 2013-01-08 11:37 UTC (permalink / raw)
To: linux-bluetooth
A pointer to freed memory is dereferenced if we call function
channel_acquire_continue() with out any earlier reference.
---
profiles/health/hdp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/profiles/health/hdp.c b/profiles/health/hdp.c
index 823621e..82419b0 100644
--- a/profiles/health/hdp.c
+++ b/profiles/health/hdp.c
@@ -609,10 +609,10 @@ static DBusMessage *channel_acquire_continue(struct hdp_tmp_dc_data *data,
data, hdp_tmp_dc_data_destroy, &gerr))
return NULL;
- hdp_tmp_dc_data_unref(data);
reply = g_dbus_create_error(data->msg, ERROR_INTERFACE ".HealthError",
"Cannot reconnect: %s", gerr->message);
g_error_free(gerr);
+ hdp_tmp_dc_data_unref(data);
return reply;
}
--
1.7.9.5
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH BlueZ 3/5] unit: Replace g_test_fail() with g_assert()
2013-01-08 11:37 [PATCH BlueZ 1/5] health: Fix pointer to local variable out-of-scope Syam Sidhardhan
2013-01-08 11:37 ` [PATCH BlueZ 2/5] health: Fix possible use after free Syam Sidhardhan
@ 2013-01-08 11:37 ` Syam Sidhardhan
2013-01-08 11:37 ` [PATCH BlueZ 4/5] audio: Remove unused struct audio_adapter Syam Sidhardhan
` (2 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Syam Sidhardhan @ 2013-01-08 11:37 UTC (permalink / raw)
To: linux-bluetooth
g_test_fail() is introduced in Glib v2.30 and we are using
Glib v2.28 as the minimum requirement for the build.
This patch resolves the compilation error that happen with
Glib v2.28.
Error log:
CC unit/test-mgmt.o
unit/test-mgmt.c: In function ‘check_actions’:
unit/test-mgmt.c:100:2: error: implicit declaration of
function ‘g_test_fail’ [-Werror=implicit-function-declaration]
cc1: all warnings being treated as errors
make[1]: *** [unit/test-mgmt.o] Error 1
make: *** [all] Error 2
---
unit/test-mgmt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/unit/test-mgmt.c b/unit/test-mgmt.c
index 2d1a5d6..ea679e5 100644
--- a/unit/test-mgmt.c
+++ b/unit/test-mgmt.c
@@ -97,7 +97,7 @@ static void check_actions(struct context *context,
}
g_test_message("Command not handled\n");
- g_test_fail();
+ g_assert(0);
}
static gboolean server_handler(GIOChannel *channel, GIOCondition cond,
--
1.7.9.5
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH BlueZ 4/5] audio: Remove unused struct audio_adapter
2013-01-08 11:37 [PATCH BlueZ 1/5] health: Fix pointer to local variable out-of-scope Syam Sidhardhan
2013-01-08 11:37 ` [PATCH BlueZ 2/5] health: Fix possible use after free Syam Sidhardhan
2013-01-08 11:37 ` [PATCH BlueZ 3/5] unit: Replace g_test_fail() with g_assert() Syam Sidhardhan
@ 2013-01-08 11:37 ` Syam Sidhardhan
2013-01-08 11:37 ` [PATCH BlueZ 5/5] sdp-xml: Remove newline before EOF Syam Sidhardhan
2013-01-09 9:15 ` [PATCH BlueZ 1/5] health: Fix pointer to local variable out-of-scope Johan Hedberg
4 siblings, 0 replies; 6+ messages in thread
From: Syam Sidhardhan @ 2013-01-08 11:37 UTC (permalink / raw)
To: linux-bluetooth
---
profiles/audio/manager.c | 6 ------
1 file changed, 6 deletions(-)
diff --git a/profiles/audio/manager.c b/profiles/audio/manager.c
index dc20712..f0df8ed 100644
--- a/profiles/audio/manager.c
+++ b/profiles/audio/manager.c
@@ -67,12 +67,6 @@
#include "manager.h"
#include "sdpd.h"
-struct audio_adapter {
- struct btd_adapter *btd_adapter;
- gboolean powered;
- gint ref;
-};
-
static GKeyFile *config = NULL;
static GSList *devices = NULL;
--
1.7.9.5
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH BlueZ 5/5] sdp-xml: Remove newline before EOF
2013-01-08 11:37 [PATCH BlueZ 1/5] health: Fix pointer to local variable out-of-scope Syam Sidhardhan
` (2 preceding siblings ...)
2013-01-08 11:37 ` [PATCH BlueZ 4/5] audio: Remove unused struct audio_adapter Syam Sidhardhan
@ 2013-01-08 11:37 ` Syam Sidhardhan
2013-01-09 9:15 ` [PATCH BlueZ 1/5] health: Fix pointer to local variable out-of-scope Johan Hedberg
4 siblings, 0 replies; 6+ messages in thread
From: Syam Sidhardhan @ 2013-01-08 11:37 UTC (permalink / raw)
To: linux-bluetooth
---
src/sdp-xml.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/src/sdp-xml.c b/src/sdp-xml.c
index 8cb1e2d..6492781 100644
--- a/src/sdp-xml.c
+++ b/src/sdp-xml.c
@@ -994,4 +994,3 @@ void convert_sdp_record_to_xml(sdp_record_t *rec,
appender(data, "</record>\n");
}
}
-
--
1.7.9.5
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH BlueZ 1/5] health: Fix pointer to local variable out-of-scope
2013-01-08 11:37 [PATCH BlueZ 1/5] health: Fix pointer to local variable out-of-scope Syam Sidhardhan
` (3 preceding siblings ...)
2013-01-08 11:37 ` [PATCH BlueZ 5/5] sdp-xml: Remove newline before EOF Syam Sidhardhan
@ 2013-01-09 9:15 ` Johan Hedberg
4 siblings, 0 replies; 6+ messages in thread
From: Johan Hedberg @ 2013-01-09 9:15 UTC (permalink / raw)
To: Syam Sidhardhan; +Cc: linux-bluetooth
Hi Syam,
On Tue, Jan 08, 2013, Syam Sidhardhan wrote:
> The address of the local variable is used outside the scope.
> ---
> profiles/health/hdp_util.c | 12 ++++--------
> 1 file changed, 4 insertions(+), 8 deletions(-)
All patches have been applied. Thanks. Btw, I made a minor fix to the
g_test_fail patch to use g_assert_not_reached() instead of (a less
intuitive imo) g_assert(0).
Johan
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2013-01-09 9:15 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-01-08 11:37 [PATCH BlueZ 1/5] health: Fix pointer to local variable out-of-scope Syam Sidhardhan
2013-01-08 11:37 ` [PATCH BlueZ 2/5] health: Fix possible use after free Syam Sidhardhan
2013-01-08 11:37 ` [PATCH BlueZ 3/5] unit: Replace g_test_fail() with g_assert() Syam Sidhardhan
2013-01-08 11:37 ` [PATCH BlueZ 4/5] audio: Remove unused struct audio_adapter Syam Sidhardhan
2013-01-08 11:37 ` [PATCH BlueZ 5/5] sdp-xml: Remove newline before EOF Syam Sidhardhan
2013-01-09 9:15 ` [PATCH BlueZ 1/5] health: Fix pointer to local variable out-of-scope Johan Hedberg
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).