* [PATCH v2] obexd: Fix null pointer dereference.
@ 2017-06-22 10:50 Matias Karhumaa
2017-06-22 11:23 ` Luiz Augusto von Dentz
0 siblings, 1 reply; 2+ messages in thread
From: Matias Karhumaa @ 2017-06-22 10:50 UTC (permalink / raw)
To: linux-bluetooth
By sending OPP Put request before CONNECT we were able to cause
SIGSEGV in obexd. Crash was caused by null pointer dereference.
Crash was found using Synopsys Defensics Obex Server test suite.
This was fixed by calling os->service->connect if CONNECT was not
done before.
---
obexd/src/obex.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/obexd/src/obex.c b/obexd/src/obex.c
index 788bffc..be79a77 100644
--- a/obexd/src/obex.c
+++ b/obexd/src/obex.c
@@ -864,6 +864,17 @@ static void cmd_put(GObex *obex, GObexPacket *req, gpointer user_data)
return;
}
+ /* OPP session don't require CONNECT, in which case just call connect
+ * callback to register the transfer.
+ */
+ if (!os->service_data && os->service->service == OBEX_OPP) {
+ os->service_data = os->service->connect(os, &err);
+ if (err < 0) {
+ os_set_response(os, err);
+ return;
+ }
+ }
+
parse_type(os, req);
if (os->driver == NULL) {
--
2.7.4
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH v2] obexd: Fix null pointer dereference.
2017-06-22 10:50 [PATCH v2] obexd: Fix null pointer dereference Matias Karhumaa
@ 2017-06-22 11:23 ` Luiz Augusto von Dentz
0 siblings, 0 replies; 2+ messages in thread
From: Luiz Augusto von Dentz @ 2017-06-22 11:23 UTC (permalink / raw)
To: Matias Karhumaa; +Cc: linux-bluetooth@vger.kernel.org
Hi Matias,
On Thu, Jun 22, 2017 at 1:50 PM, Matias Karhumaa
<matias.karhumaa@gmail.com> wrote:
> By sending OPP Put request before CONNECT we were able to cause
> SIGSEGV in obexd. Crash was caused by null pointer dereference.
> Crash was found using Synopsys Defensics Obex Server test suite.
>
> This was fixed by calling os->service->connect if CONNECT was not
> done before.
> ---
> obexd/src/obex.c | 11 +++++++++++
> 1 file changed, 11 insertions(+)
>
> diff --git a/obexd/src/obex.c b/obexd/src/obex.c
> index 788bffc..be79a77 100644
> --- a/obexd/src/obex.c
> +++ b/obexd/src/obex.c
> @@ -864,6 +864,17 @@ static void cmd_put(GObex *obex, GObexPacket *req, gpointer user_data)
> return;
> }
>
> + /* OPP session don't require CONNECT, in which case just call connect
> + * callback to register the transfer.
> + */
> + if (!os->service_data && os->service->service == OBEX_OPP) {
> + os->service_data = os->service->connect(os, &err);
> + if (err < 0) {
> + os_set_response(os, err);
> + return;
> + }
> + }
> +
> parse_type(os, req);
>
> if (os->driver == NULL) {
> --
> 2.7.4
Applied, thanks.
--
Luiz Augusto von Dentz
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-06-22 11:23 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-06-22 10:50 [PATCH v2] obexd: Fix null pointer dereference Matias Karhumaa
2017-06-22 11:23 ` Luiz Augusto von Dentz
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox