* [PATCH] android/health: Fix NULL dereference
@ 2014-08-20 7:02 Andrei Emeltchenko
2014-08-20 10:02 ` Szymon Janc
0 siblings, 1 reply; 4+ messages in thread
From: Andrei Emeltchenko @ 2014-08-20 7:02 UTC (permalink / raw)
To: linux-bluetooth
From: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
In a case get_app(), get_device(), get_channel() fail prevent
dereference of NULL pointer. Fixes clang warnings:
...
android/health.c:1980:15: warning: Access to field 'dev' results in a
dereference of a null pointer (loaded from variable 'channel')
queue_remove(channel->dev->channels, channel);
^~~~~~~~~~~~
1 warning generated.
...
---
android/health.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/android/health.c b/android/health.c
index c8af90e..665482e 100644
--- a/android/health.c
+++ b/android/health.c
@@ -1931,15 +1931,15 @@ static void bt_health_connect_channel(const void *buf, uint16_t len)
app = get_app(cmd->app_id);
if (!app)
- goto fail;
+ goto send_rsp;
dev = get_device(app, cmd->bdaddr);
if (!dev)
- goto fail;
+ goto send_rsp;
channel = get_channel(app, cmd->mdep_index, dev);
if (!channel)
- goto fail;
+ goto send_rsp;
if (!queue_length(dev->channels)) {
if (channel->type != CHANNEL_TYPE_RELIABLE) {
@@ -1979,6 +1979,8 @@ static void bt_health_connect_channel(const void *buf, uint16_t len)
fail:
queue_remove(channel->dev->channels, channel);
free_health_channel(channel);
+
+send_rsp:
ipc_send_rsp(hal_ipc, HAL_SERVICE_ID_HEALTH,
HAL_OP_HEALTH_CONNECT_CHANNEL, HAL_STATUS_FAILED);
}
--
1.9.1
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] android/health: Fix NULL dereference
2014-08-20 7:02 [PATCH] android/health: Fix NULL dereference Andrei Emeltchenko
@ 2014-08-20 10:02 ` Szymon Janc
0 siblings, 0 replies; 4+ messages in thread
From: Szymon Janc @ 2014-08-20 10:02 UTC (permalink / raw)
To: Andrei Emeltchenko; +Cc: linux-bluetooth
Hi Andrei,
On Wednesday 20 of August 2014 10:02:03 Andrei Emeltchenko wrote:
> From: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
>
> In a case get_app(), get_device(), get_channel() fail prevent
> dereference of NULL pointer. Fixes clang warnings:
> ...
> android/health.c:1980:15: warning: Access to field 'dev' results in a
> dereference of a null pointer (loaded from variable 'channel')
> queue_remove(channel->dev->channels, channel);
> ^~~~~~~~~~~~
> 1 warning generated.
> ...
> ---
> android/health.c | 8 +++++---
> 1 file changed, 5 insertions(+), 3 deletions(-)
>
> diff --git a/android/health.c b/android/health.c
> index c8af90e..665482e 100644
> --- a/android/health.c
> +++ b/android/health.c
> @@ -1931,15 +1931,15 @@ static void bt_health_connect_channel(const void
> *buf, uint16_t len)
>
> app = get_app(cmd->app_id);
> if (!app)
> - goto fail;
> + goto send_rsp;
>
> dev = get_device(app, cmd->bdaddr);
> if (!dev)
> - goto fail;
> + goto send_rsp;
>
> channel = get_channel(app, cmd->mdep_index, dev);
> if (!channel)
> - goto fail;
> + goto send_rsp;
>
> if (!queue_length(dev->channels)) {
> if (channel->type != CHANNEL_TYPE_RELIABLE) {
> @@ -1979,6 +1979,8 @@ static void bt_health_connect_channel(const void *buf,
> uint16_t len) fail:
> queue_remove(channel->dev->channels, channel);
> free_health_channel(channel);
> +
> +send_rsp:
> ipc_send_rsp(hal_ipc, HAL_SERVICE_ID_HEALTH,
> HAL_OP_HEALTH_CONNECT_CHANNEL, HAL_STATUS_FAILED);
> }
Applied, thanks.
--
BR
Szymon Janc
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH] android/health: Fix NULL dereference
@ 2014-06-27 14:07 Andrei Emeltchenko
2014-06-27 14:12 ` Szymon Janc
0 siblings, 1 reply; 4+ messages in thread
From: Andrei Emeltchenko @ 2014-06-27 14:07 UTC (permalink / raw)
To: linux-bluetooth
From: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
---
android/health.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/android/health.c b/android/health.c
index 5f86727..2dc35d4 100644
--- a/android/health.c
+++ b/android/health.c
@@ -1878,7 +1878,7 @@ static void channel_delete_cb(GError *gerr, gpointer data)
DBG("");
- if (!gerr) {
+ if (gerr) {
error("health: channel delete failed %s", gerr->message);
return;
}
--
1.8.3.2
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] android/health: Fix NULL dereference
2014-06-27 14:07 Andrei Emeltchenko
@ 2014-06-27 14:12 ` Szymon Janc
0 siblings, 0 replies; 4+ messages in thread
From: Szymon Janc @ 2014-06-27 14:12 UTC (permalink / raw)
To: Andrei Emeltchenko; +Cc: linux-bluetooth
Hi Andrei,
On Friday 27 of June 2014 17:07:34 Andrei Emeltchenko wrote:
> From: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
>
> ---
> android/health.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/android/health.c b/android/health.c
> index 5f86727..2dc35d4 100644
> --- a/android/health.c
> +++ b/android/health.c
> @@ -1878,7 +1878,7 @@ static void channel_delete_cb(GError *gerr, gpointer data)
>
> DBG("");
>
> - if (!gerr) {
> + if (gerr) {
> error("health: channel delete failed %s", gerr->message);
> return;
> }
>
Applied, thanks.
--
Best regards,
Szymon Janc
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2014-08-20 10:02 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-08-20 7:02 [PATCH] android/health: Fix NULL dereference Andrei Emeltchenko
2014-08-20 10:02 ` Szymon Janc
-- strict thread matches above, loose matches on Subject: below --
2014-06-27 14:07 Andrei Emeltchenko
2014-06-27 14:12 ` Szymon Janc
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox