Hi folks:

I am having problems with a Samsung SGH-D500 mobile phone. I do the
following:

pm@PM:~/Development/picdproto> sdptool search DUN
Inquiring ...
Searching for DUN on 00:12:47:63:FB:2A ...
Service Name: Dial-up networking
Service RecHandle: 0x10002
Service Class ID List:
      "Error: This is uuid32" (0x00001103)
Protocol Descriptor List:
      "Error: " (0x00000100)
      "Error: " (0x00000003)
        Channel: 4
Segmentation fault

I have attached the output of "hcidump -X".

Using gdb, I have found that the offending instruction is in
bluez-libs-2.xx/src/sdp.c. It is produced in the library function
sdp_get_profile_descs(), in the line

	...
	sdp_data_t *pVnum = seq->val.dataseq->next;
	...

It seems that the problem is that "seq->val.dataseq" points to an
out-of-memory address (in my case, it was 0x1a), so trying to get the
"next" field raises SIGSEGV.

I do not quite understand all bluez structures (sdp_data_t and similar),
so I do not know exactly what went wrong. My guess is that the SDP
information sent by the mobile phone was corrupt or bogus and that the
bluez SDP code did not handled it correctly.

I hope that this information could help to fix this.

Regards,

Pedro Monjo