From: Matias Karhumaa <matias.karhumaa@gmail.com>
To: linux-bluetooth@vger.kernel.org
Subject: [PATCH] obexd: Fix null pointer dereference.
Date: Wed, 21 Jun 2017 09:14:01 +0300 [thread overview]
Message-ID: <20170621061358.GA17661@makarhum-e6330> (raw)
By sending OPP Put request before CONNECT we were able to cause
SIGSEGV in obexd. Crash was caused by null pointer dereference.
gdb output:
Program received signal SIGSEGV, Segmentation fault.
manager_request_authorization (transfer=transfer@entry=0x0, new_folder=new_folder@entry=0x7fffffffda18, new_name=new_name@entry=0x7fffffffda20) at obexd/src/manager.c:677
677 struct obex_session *os = transfer->session;
(gdb) bt
*#0 manager_request_authorization (transfer=transfer@entry=0x0, new_folder=new_folder@entry=0x7fffffffda18, new_name=new_name@entry=0x7fffffffda20) at obexd/src/manager.c:677
*#1 0x000000000041b7a5 in opp_chkput (os=0x67de60, user_data=0x0) at obexd/plugins/opp.c:80
*#2 0x0000000000426cc5 in check_put (obex=0x678a50, req=0x679250, user_data=0x67de60) at obexd/src/obex.c:831
*#3 cmd_put (obex=0x678a50, req=0x679250, user_data=0x67de60) at obexd/src/obex.c:887
*#4 0x00000000004145e7 in handle_request (req=0x679250, obex=0x678a50) at gobex/gobex.c:1199
*#5 incoming_data (io=<optimized out>, cond=<optimized out>, user_data=0x678a50) at gobex/gobex.c:1375
*#6 0x00007ffff749204a in g_main_dispatch (context=0x674810) at /build/glib2.0-prJhLS/glib2.0-2.48.2/./glib/gmain.c:3154
*#7 g_main_context_dispatch (context=context@entry=0x674810) at /build/glib2.0-prJhLS/glib2.0-2.48.2/./glib/gmain.c:3769
*#8 0x00007ffff74923f0 in g_main_context_iterate (context=0x674810, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>)
at /build/glib2.0-prJhLS/glib2.0-2.48.2/./glib/gmain.c:3840
*#9 0x00007ffff7492712 in g_main_loop_run (loop=0x66fdf0) at /build/glib2.0-prJhLS/glib2.0-2.48.2/./glib/gmain.c:4034
*#10 0x000000000040dd0f in main (argc=1, argv=0x7fffffffde08) at obexd/src/main.c:322
Crash was found using Synopsys Defensics Obex Server test suite.
---
obexd/src/obex.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/obexd/src/obex.c b/obexd/src/obex.c
index 788bffc..91fa838 100644
--- a/obexd/src/obex.c
+++ b/obexd/src/obex.c
@@ -825,7 +825,7 @@ static gboolean check_put(GObex *obex, GObexPacket *req, void *user_data)
struct obex_session *os = user_data;
int ret;
- if (os->service->chkput == NULL)
+ if (os->service->chkput == NULL || os->service_data == NULL)
goto done;
ret = os->service->chkput(os, os->service_data);
--
2.7.4
next reply other threads:[~2017-06-21 6:14 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-06-21 6:14 Matias Karhumaa [this message]
2017-06-21 9:41 ` [PATCH] obexd: Fix null pointer dereference Johan Hedberg
2017-06-21 17:36 ` Luiz Augusto von Dentz
2017-06-21 19:31 ` Luiz Augusto von Dentz
2017-06-22 4:32 ` Matias Karhumaa
2017-06-22 6:18 ` Johan Hedberg
2017-06-22 10:20 ` Matias Karhumaa
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170621061358.GA17661@makarhum-e6330 \
--to=matias.karhumaa@gmail.com \
--cc=linux-bluetooth@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox