[PATCH] Fix possible crash while verifying avdtp version

[PATCH] Fix possible crash while verifying avdtp version

[Luiz Augusto von Dentz]

[-- Attachment #1: Type: text/plain, Size: 340 bytes --]

Hi,

Codenomicon a2dp tests makes bluetoothd to crash due to a malformed
sdp record (BlueZ 4.60):

Signal 11 (SIGSEGV)
0		avdtp_get_internal () at audio/avdtp.c:2073
1	0x00022f18	avdtp_confirm_cb (chan=0x6c0e0) at audio/avdtp.c:2266
2	0x0003a7dc	server_cb (user_data=0x6d380) at src/btio.c:193

-- 
Luiz Augusto von Dentz
Computer Engineer

[-- Attachment #2: 0001-Fix-possible-crash-while-verifying-avdtp-version.patch --]
[-- Type: text/x-patch, Size: 824 bytes --]

From 9fa60aa616ed1e6c7278f0cb265c881c80e628f3 Mon Sep 17 00:00:00 2001
From: Luiz Augusto Von Dentz <luiz.dentz-von@nokia.com>
Date: Wed, 17 Feb 2010 11:22:16 +0200
Subject: [PATCH] Fix possible crash while verifying avdtp version

Reproducible with Codenomicon A2DP testsuite 1.4.2.
---
 audio/avdtp.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/audio/avdtp.c b/audio/avdtp.c
index 3b9c6c1..efed9b6 100644
--- a/audio/avdtp.c
+++ b/audio/avdtp.c
@@ -2125,7 +2125,7 @@ static uint16_t get_version(struct avdtp *session)
 		goto done;
 
 	proto_desc = sdp_get_proto_desc(protos, AVDTP_UUID);
-	if (proto_desc->dtd == SDP_UINT16)
+	if (proto_desc && proto_desc->dtd == SDP_UINT16)
 		ver = proto_desc->val.uint16;
 
 	sdp_list_foreach(protos, (sdp_list_func_t) sdp_list_free, NULL);
-- 
1.6.3.3

Re: [PATCH] Fix possible crash while verifying avdtp version

[Marcel Holtmann]

Hi Luiz,

> Codenomicon a2dp tests makes bluetoothd to crash due to a malformed
> sdp record (BlueZ 4.60):
> 
> Signal 11 (SIGSEGV)
> 0		avdtp_get_internal () at audio/avdtp.c:2073
> 1	0x00022f18	avdtp_confirm_cb (chan=0x6c0e0) at audio/avdtp.c:2266
> 2	0x0003a7dc	server_cb (user_data=0x6d380) at src/btio.c:193

patch has been applied. Thanks.

Regards

Marcel