[PATCH] obexd: reject to accept file when replying any error message

[PATCH] obexd: reject to accept file when replying any error message

[Chengyi Zhao]

For security reasons, it will reject the file when the obex
agent replies with any error message, and accept the file
when the obex agent replies with the new file name.
---
 obexd/src/manager.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/obexd/src/manager.c b/obexd/src/manager.c
index 5a6fd9b4b..cecf9f90a 100644
--- a/obexd/src/manager.c
+++ b/obexd/src/manager.c
@@ -658,6 +658,8 @@ static void agent_reply(DBusPendingCall *call, void *user_data)
 				agent->new_name = g_strdup(slash + 1);
 			agent->new_folder = g_strndup(name, slash - name);
 		}
+
+		agent->auth_reject = FALSE;
 	}
 
 	dbus_message_unref(reply);
@@ -703,7 +705,7 @@ int manager_request_authorization(struct obex_transfer *transfer,
 	dbus_message_unref(msg);
 
 	agent->auth_pending = TRUE;
-	agent->auth_reject  = FALSE;
+	agent->auth_reject  = TRUE;
 	got_reply = FALSE;
 
 	/* Catches errors before authorization response comes */
-- 
2.20.1

Re: [PATCH] obexd: reject to accept file when replying any error message

[Paul Menzel]

[Cc: -stable@, as obexd is not part of the Linux kernel]

Dear Chengyi,


Thank you for your patch.

Am 30.06.25 um 15:54 schrieb Chengyi Zhao:
> For security reasons, it will reject the file when the obex

Could you please elaborate on the attack?

> agent replies with any error message, and accept the file
> when the obex agent replies with the new file name.
> ---
>   obexd/src/manager.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)


Kind regards,

Paul


> 
> diff --git a/obexd/src/manager.c b/obexd/src/manager.c
> index 5a6fd9b4b..cecf9f90a 100644
> --- a/obexd/src/manager.c
> +++ b/obexd/src/manager.c
> @@ -658,6 +658,8 @@ static void agent_reply(DBusPendingCall *call, void *user_data)
>   				agent->new_name = g_strdup(slash + 1);
>   			agent->new_folder = g_strndup(name, slash - name);
>   		}
> +
> +		agent->auth_reject = FALSE;
>   	}
>   
>   	dbus_message_unref(reply);
> @@ -703,7 +705,7 @@ int manager_request_authorization(struct obex_transfer *transfer,
>   	dbus_message_unref(msg);
>   
>   	agent->auth_pending = TRUE;
> -	agent->auth_reject  = FALSE;
> +	agent->auth_reject  = TRUE;
>   	got_reply = FALSE;
>   
>   	/* Catches errors before authorization response comes */

RE: obexd: reject to accept file when replying any error message

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1261 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=977338

---Test result---

Test Summary:
CheckPatch                    PENDING   0.34 seconds
GitLint                       PENDING   0.38 seconds
BuildEll                      PASS      20.07 seconds
BluezMake                     PASS      2688.34 seconds
MakeCheck                     PASS      20.17 seconds
MakeDistcheck                 PASS      200.31 seconds
CheckValgrind                 PASS      278.28 seconds
CheckSmatch                   PASS      307.30 seconds
bluezmakeextell               PASS      129.02 seconds
IncrementalBuild              PENDING   0.29 seconds
ScanBuild                     PASS      918.25 seconds

Details
##############################
Test: CheckPatch - PENDING
Desc: Run checkpatch.pl script
Output:

##############################
Test: GitLint - PENDING
Desc: Run gitlint
Output:

##############################
Test: IncrementalBuild - PENDING
Desc: Incremental build with the patches in the series
Output:



---
Regards,
Linux Bluetooth