* [PATCH 1/2] shared/gatt: Fix NULL dereference
@ 2014-12-19 9:25 Andrei Emeltchenko
2014-12-19 9:25 ` [PATCH 2/2] tools/gatt: Fix not checking malloc() failure Andrei Emeltchenko
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: Andrei Emeltchenko @ 2014-12-19 9:25 UTC (permalink / raw)
To: linux-bluetooth
From: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
The which is executed after checking (!op) is dereferencing op in
function discovery_op_free().
---
src/shared/gatt-client.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/src/shared/gatt-client.c b/src/shared/gatt-client.c
index f7a90d1..c9fb05d 100644
--- a/src/shared/gatt-client.c
+++ b/src/shared/gatt-client.c
@@ -1075,11 +1075,12 @@ static void process_service_changed(struct bt_gatt_client *client,
return;
}
+ discovery_op_free(op);
+
fail:
util_debug(client->debug_callback, client->debug_data,
"Failed to initiate service discovery"
" after Service Changed");
- discovery_op_free(op);
}
static void service_changed_cb(uint16_t value_handle, const uint8_t *value,
--
2.1.0
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH 2/2] tools/gatt: Fix not checking malloc() failure
2014-12-19 9:25 [PATCH 1/2] shared/gatt: Fix NULL dereference Andrei Emeltchenko
@ 2014-12-19 9:25 ` Andrei Emeltchenko
2014-12-22 11:32 ` [PATCH 1/2] shared/gatt: Fix NULL dereference Andrei Emeltchenko
2015-01-09 9:45 ` Johan Hedberg
2 siblings, 0 replies; 6+ messages in thread
From: Andrei Emeltchenko @ 2014-12-19 9:25 UTC (permalink / raw)
To: linux-bluetooth
From: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
This follows standard practice elsewhere in this file.
---
tools/btgatt-client.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/tools/btgatt-client.c b/tools/btgatt-client.c
index e2e0537..62c4d3e 100644
--- a/tools/btgatt-client.c
+++ b/tools/btgatt-client.c
@@ -457,6 +457,10 @@ static void cmd_read_multiple(struct client *cli, char *cmd_str)
}
value = malloc(sizeof(uint16_t) * argc);
+ if (!value) {
+ printf("Failed to construct value\n");
+ return;
+ }
for (i = 0; i < argc; i++) {
value[i] = strtol(argv[i], &endptr, 0);
--
2.1.0
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH 1/2] shared/gatt: Fix NULL dereference
2014-12-19 9:25 [PATCH 1/2] shared/gatt: Fix NULL dereference Andrei Emeltchenko
2014-12-19 9:25 ` [PATCH 2/2] tools/gatt: Fix not checking malloc() failure Andrei Emeltchenko
@ 2014-12-22 11:32 ` Andrei Emeltchenko
2015-01-08 14:20 ` Andrei Emeltchenko
2015-01-09 9:45 ` Johan Hedberg
2 siblings, 1 reply; 6+ messages in thread
From: Andrei Emeltchenko @ 2014-12-22 11:32 UTC (permalink / raw)
To: linux-bluetooth
ping
On Fri, Dec 19, 2014 at 11:25:23AM +0200, Andrei Emeltchenko wrote:
> From: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
>
> The which is executed after checking (!op) is dereferencing op in
> function discovery_op_free().
> ---
> src/shared/gatt-client.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/src/shared/gatt-client.c b/src/shared/gatt-client.c
> index f7a90d1..c9fb05d 100644
> --- a/src/shared/gatt-client.c
> +++ b/src/shared/gatt-client.c
> @@ -1075,11 +1075,12 @@ static void process_service_changed(struct bt_gatt_client *client,
> return;
> }
>
> + discovery_op_free(op);
> +
> fail:
> util_debug(client->debug_callback, client->debug_data,
> "Failed to initiate service discovery"
> " after Service Changed");
> - discovery_op_free(op);
> }
>
> static void service_changed_cb(uint16_t value_handle, const uint8_t *value,
> --
> 2.1.0
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 1/2] shared/gatt: Fix NULL dereference
2014-12-22 11:32 ` [PATCH 1/2] shared/gatt: Fix NULL dereference Andrei Emeltchenko
@ 2015-01-08 14:20 ` Andrei Emeltchenko
0 siblings, 0 replies; 6+ messages in thread
From: Andrei Emeltchenko @ 2015-01-08 14:20 UTC (permalink / raw)
To: linux-bluetooth
ping
On Mon, Dec 22, 2014 at 01:32:56PM +0200, Andrei Emeltchenko wrote:
> ping
>
> On Fri, Dec 19, 2014 at 11:25:23AM +0200, Andrei Emeltchenko wrote:
> > From: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
> >
> > The which is executed after checking (!op) is dereferencing op in
> > function discovery_op_free().
> > ---
> > src/shared/gatt-client.c | 3 ++-
> > 1 file changed, 2 insertions(+), 1 deletion(-)
> >
> > diff --git a/src/shared/gatt-client.c b/src/shared/gatt-client.c
> > index f7a90d1..c9fb05d 100644
> > --- a/src/shared/gatt-client.c
> > +++ b/src/shared/gatt-client.c
> > @@ -1075,11 +1075,12 @@ static void process_service_changed(struct bt_gatt_client *client,
> > return;
> > }
> >
> > + discovery_op_free(op);
> > +
> > fail:
> > util_debug(client->debug_callback, client->debug_data,
> > "Failed to initiate service discovery"
> > " after Service Changed");
> > - discovery_op_free(op);
> > }
> >
> > static void service_changed_cb(uint16_t value_handle, const uint8_t *value,
> > --
> > 2.1.0
> >
> > --
> > To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in
> > the body of a message to majordomo@vger.kernel.org
> > More majordomo info at http://vger.kernel.org/majordomo-info.html
> --
> To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 1/2] shared/gatt: Fix NULL dereference
2014-12-19 9:25 [PATCH 1/2] shared/gatt: Fix NULL dereference Andrei Emeltchenko
2014-12-19 9:25 ` [PATCH 2/2] tools/gatt: Fix not checking malloc() failure Andrei Emeltchenko
2014-12-22 11:32 ` [PATCH 1/2] shared/gatt: Fix NULL dereference Andrei Emeltchenko
@ 2015-01-09 9:45 ` Johan Hedberg
2 siblings, 0 replies; 6+ messages in thread
From: Johan Hedberg @ 2015-01-09 9:45 UTC (permalink / raw)
To: Andrei Emeltchenko; +Cc: linux-bluetooth
Hi Andrei,
On Fri, Dec 19, 2014, Andrei Emeltchenko wrote:
> The which is executed after checking (!op) is dereferencing op in
> function discovery_op_free().
> ---
> src/shared/gatt-client.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
Both patches in this set have been applied. Thanks.
Johan
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 1/2] shared/gatt: Fix NULL dereference
@ 2014-12-05 7:30 Andrei Emeltchenko
0 siblings, 0 replies; 6+ messages in thread
From: Andrei Emeltchenko @ 2014-12-05 7:30 UTC (permalink / raw)
To: linux-bluetooth
From: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
The which is executed after checking (!op) is dereferencing op in
function discovery_op_free().
---
src/shared/gatt-client.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/src/shared/gatt-client.c b/src/shared/gatt-client.c
index 463de3b..96b5f1f 100644
--- a/src/shared/gatt-client.c
+++ b/src/shared/gatt-client.c
@@ -1101,11 +1101,12 @@ static void process_service_changed(struct bt_gatt_client *client,
return;
}
+ discovery_op_free(op);
+
fail:
util_debug(client->debug_callback, client->debug_data,
"Failed to initiate service discovery"
" after Service Changed");
- discovery_op_free(op);
}
static void service_changed_cb(uint16_t value_handle, const uint8_t *value,
--
1.9.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2015-01-09 9:45 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-12-19 9:25 [PATCH 1/2] shared/gatt: Fix NULL dereference Andrei Emeltchenko
2014-12-19 9:25 ` [PATCH 2/2] tools/gatt: Fix not checking malloc() failure Andrei Emeltchenko
2014-12-22 11:32 ` [PATCH 1/2] shared/gatt: Fix NULL dereference Andrei Emeltchenko
2015-01-08 14:20 ` Andrei Emeltchenko
2015-01-09 9:45 ` Johan Hedberg
-- strict thread matches above, loose matches on Subject: below --
2014-12-05 7:30 Andrei Emeltchenko
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).