[PATCH BlueZ 0/1] shared/shell: Fix SIGSEGV on invalid input

[PATCH BlueZ 0/1] shared/shell: Fix SIGSEGV on invalid input

[Wouter]

In `bluetoothctl` when entering a space followed by a tab the CLI
crashes with a segfault. This patch fixes the user input handling.

Wouter (1):
  shared/shell: Fix SIGSEGV on invalid input

 src/shared/shell.c | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

-- 
2.53.0

[PATCH BlueZ 1/1] shared/shell: Fix SIGSEGV on invalid input

[Wouter]

This fixes a crash when handling "<space><tab>"
---
 src/shared/shell.c | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/src/shared/shell.c b/src/shared/shell.c
index b061f8001..57bba0977 100644
--- a/src/shared/shell.c
+++ b/src/shared/shell.c
@@ -1174,15 +1174,17 @@ static char **shell_completion(const char *text, int start, int end)
 		if (wordexp(rl_line_buffer, &w, WRDE_NOCMD))
 			return NULL;
 
-		matches = menu_completion(default_menu.entries, text,
-						w.we_wordc, w.we_wordv[0]);
-		if (!matches) {
-			matches = menu_completion(data.menu->entries, text,
-							w.we_wordc,
-							w.we_wordv[0]);
-			if (!matches)
-				matches = submenu_completion(text, w.we_wordc,
+		if (w.we_wordc != 0) {
+			matches = menu_completion(default_menu.entries, text,
+							w.we_wordc, w.we_wordv[0]);
+			if (!matches) {
+				matches = menu_completion(data.menu->entries, text,
+								w.we_wordc,
 								w.we_wordv[0]);
+				if (!matches)
+					matches = submenu_completion(text, w.we_wordc,
+									w.we_wordv[0]);
+			}
 		}
 
 		wordfree(&w);
-- 
2.53.0

RE: shared/shell: Fix SIGSEGV on invalid input

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1671 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1068955

---Test result---

Test Summary:
CheckPatch                    PENDING   0.30 seconds
GitLint                       PENDING   0.36 seconds
BuildEll                      PASS      21.23 seconds
BluezMake                     PASS      633.50 seconds
MakeCheck                     PASS      18.51 seconds
MakeDistcheck                 PASS      244.32 seconds
CheckValgrind                 PASS      291.23 seconds
CheckSmatch                   WARNING   352.53 seconds
bluezmakeextell               PASS      181.41 seconds
IncrementalBuild              PENDING   0.31 seconds
ScanBuild                     PASS      1008.74 seconds

Details
##############################
Test: CheckPatch - PENDING
Desc: Run checkpatch.pl script
Output:

##############################
Test: GitLint - PENDING
Desc: Run gitlint
Output:

##############################
Test: CheckSmatch - WARNING
Desc: Run smatch tool with source
Output:
src/shared/shell.c: note: in included file (through /usr/include/readline/readline.h):src/shared/shell.c: note: in included file (through /usr/include/readline/readline.h):src/shared/shell.c: note: in included file (through /usr/include/readline/readline.h):
##############################
Test: IncrementalBuild - PENDING
Desc: Incremental build with the patches in the series
Output:



https://github.com/bluez/bluez/pull/1970/checks

---
Regards,
Linux Bluetooth

Re: [PATCH BlueZ 1/1] shared/shell: Fix SIGSEGV on invalid input

[Bastien Nocera]

On Thu, 2026-03-19 at 03:16 +0100, Wouter wrote:
> This fixes a crash when handling "<space><tab>"

That looks good to me, but is there any chance you could add the
valgrind output when reproducing this crash?

This should show the exact line where the problem is.

I would also add an explanation to the commit message like:
"Make sure to check w.we_wordc (word count) before accessing w.we_wordv
(word array)"

Cheers

> ---
>  src/shared/shell.c | 18 ++++++++++--------
>  1 file changed, 10 insertions(+), 8 deletions(-)
> 
> diff --git a/src/shared/shell.c b/src/shared/shell.c
> index b061f8001..57bba0977 100644
> --- a/src/shared/shell.c
> +++ b/src/shared/shell.c
> @@ -1174,15 +1174,17 @@ static char **shell_completion(const char
> *text, int start, int end)
>  		if (wordexp(rl_line_buffer, &w, WRDE_NOCMD))
>  			return NULL;
>  
> -		matches = menu_completion(default_menu.entries,
> text,
> -						w.we_wordc,
> w.we_wordv[0]);
> -		if (!matches) {
> -			matches = menu_completion(data.menu-
> >entries, text,
> -							w.we_wordc,
> -
> 							w.we_wordv[0]);
> -			if (!matches)
> -				matches = submenu_completion(text,
> w.we_wordc,
> +		if (w.we_wordc != 0) {
> +			matches =
> menu_completion(default_menu.entries, text,
> +							w.we_wordc,
> w.we_wordv[0]);
> +			if (!matches) {
> +				matches = menu_completion(data.menu-
> >entries, text,
> +								w.we
> _wordc,
>  								w.we
> _wordv[0]);
> +				if (!matches)
> +					matches =
> submenu_completion(text, w.we_wordc,
> +								
> 	w.we_wordv[0]);
> +			}
>  		}
>  
>  		wordfree(&w);

Re: [PATCH BlueZ 1/1] shared/shell: Fix SIGSEGV on invalid input

[Bastien Nocera]

On Thu, 2026-03-19 at 12:08 +0100, Bastien Nocera wrote:
> On Thu, 2026-03-19 at 03:16 +0100, Wouter wrote:
> > This fixes a crash when handling "<space><tab>"
> 
> That looks good to me, but is there any chance you could add the
> valgrind output when reproducing this crash?
> 
> This should show the exact line where the problem is.
> 
> I would also add an explanation to the commit message like:
> "Make sure to check w.we_wordc (word count) before accessing
> w.we_wordv
> (word array)"

Actually, looking at the valgrind output:
==1430873== Invalid read of size 1
==1430873==    at 0x484BC77: strcmp (vg_replace_strmem.c:941)
==1430873==    by 0x435063: menu_completion (shell.c:1126)
==1430873==    by 0x4352F0: shell_completion (shell.c:1177)
==1430873==    by 0x4A2542B: gen_completion_matches (complete.c:1282)
==1430873==    by 0x4A2E9CD: rl_complete_internal (complete.c:2104)
==1430873==    by 0x4A257C2: _rl_dispatch_subseq (readline.c:944)
==1430873==    by 0x4A26ADF: readline_internal_char (readline.c:693)
==1430873==    by 0x4A46CE4: rl_callback_read_char (callback.c:275)
==1430873==    by 0x435E54: bt_shell_input_line (shell.c:309)
==1430873==    by 0x436A34: watch_callback (io-glib.c:173)
==1430873==    by 0x490A322: g_main_dispatch (gmain.c:3565)
==1430873==    by 0x490A322:
g_main_context_dispatch_unlocked.lto_priv.0 (gmain.c:4425)
==1430873==    by 0x4913277: g_main_context_iterate_unlocked.isra.0
(gmain.c:4490)
==1430873==  Address 0x0 is not stack'd, malloc'd or (recently) free'd

I think that a check in src/shared/shell.c might be better (and would
avoid having to fix the bug in 6 other places). Something like this?

--- a/src/shared/shell.c
+++ b/src/shared/shell.c
@@ -1122,6 +1122,9 @@ static char **menu_completion(const struct bt_shell_menu_entry *entry,
 {
        char **matches = NULL;
 
+       if (argc == 0)
+               return NULL;
+
        for (; entry->cmd; entry++) {
                if (strcmp(entry->cmd, input_cmd))
                        continue;
@@ -1146,6 +1149,8 @@ static char **submenu_completion(const char *text, int argc, char *input_cmd)
 
        if (data.main != data.menu)
                return NULL;
+       if (!input_cmd)
+               return NULL;
 
        cmd = strrchr(input_cmd, '.');
        if (!cmd)

Let me know if you want to send a v2 with the mentioned changes instead.

> 
> Cheers
> 
> > ---
> >  src/shared/shell.c | 18 ++++++++++--------
> >  1 file changed, 10 insertions(+), 8 deletions(-)
> > 
> > diff --git a/src/shared/shell.c b/src/shared/shell.c
> > index b061f8001..57bba0977 100644
> > --- a/src/shared/shell.c
> > +++ b/src/shared/shell.c
> > @@ -1174,15 +1174,17 @@ static char **shell_completion(const char
> > *text, int start, int end)
> >  		if (wordexp(rl_line_buffer, &w, WRDE_NOCMD))
> >  			return NULL;
> >  
> > -		matches = menu_completion(default_menu.entries,
> > text,
> > -						w.we_wordc,
> > w.we_wordv[0]);
> > -		if (!matches) {
> > -			matches = menu_completion(data.menu-
> > > entries, text,
> > -
> > 							w.we_wordc,
> > -
> > 							w.we_wordv
> > [0]);
> > -			if (!matches)
> > -				matches = submenu_completion(text,
> > w.we_wordc,
> > +		if (w.we_wordc != 0) {
> > +			matches =
> > menu_completion(default_menu.entries, text,
> > +							w.we_wordc
> > ,
> > w.we_wordv[0]);
> > +			if (!matches) {
> > +				matches =
> > menu_completion(data.menu-
> > > entries, text,
> > +								w.
> > we
> > _wordc,
> >  								w.
> > we
> > _wordv[0]);
> > +				if (!matches)
> > +					matches =
> > submenu_completion(text, w.we_wordc,
> > +								
> > 	w.we_wordv[0]);
> > +			}
> >  		}
> >  
> >  		wordfree(&w);

Re: [PATCH BlueZ 1/1] shared/shell: Fix SIGSEGV on invalid input

[Wouter]

I'll send in a v2. I had shell_completion changed instead as it's the
sole caller of those methods, and would mean it bails early rather than
further down the callstack. Your suggestions are cleaner though, so
i'll adjust and re-submit.

- Wouter

On Thu, 2026-03-19 at 12:15 +0100, Bastien Nocera wrote:
> On Thu, 2026-03-19 at 12:08 +0100, Bastien Nocera wrote:
> > On Thu, 2026-03-19 at 03:16 +0100, Wouter wrote:
> > > This fixes a crash when handling "<space><tab>"
> > 
> > That looks good to me, but is there any chance you could add the
> > valgrind output when reproducing this crash?
> > 
> > This should show the exact line where the problem is.
> > 
> > I would also add an explanation to the commit message like:
> > "Make sure to check w.we_wordc (word count) before accessing
> > w.we_wordv
> > (word array)"
> 
> Actually, looking at the valgrind output:
> ==1430873== Invalid read of size 1
> ==1430873==    at 0x484BC77: strcmp (vg_replace_strmem.c:941)
> ==1430873==    by 0x435063: menu_completion (shell.c:1126)
> ==1430873==    by 0x4352F0: shell_completion (shell.c:1177)
> ==1430873==    by 0x4A2542B: gen_completion_matches (complete.c:1282)
> ==1430873==    by 0x4A2E9CD: rl_complete_internal (complete.c:2104)
> ==1430873==    by 0x4A257C2: _rl_dispatch_subseq (readline.c:944)
> ==1430873==    by 0x4A26ADF: readline_internal_char (readline.c:693)
> ==1430873==    by 0x4A46CE4: rl_callback_read_char (callback.c:275)
> ==1430873==    by 0x435E54: bt_shell_input_line (shell.c:309)
> ==1430873==    by 0x436A34: watch_callback (io-glib.c:173)
> ==1430873==    by 0x490A322: g_main_dispatch (gmain.c:3565)
> ==1430873==    by 0x490A322:
> g_main_context_dispatch_unlocked.lto_priv.0 (gmain.c:4425)
> ==1430873==    by 0x4913277: g_main_context_iterate_unlocked.isra.0
> (gmain.c:4490)
> ==1430873==  Address 0x0 is not stack'd, malloc'd or (recently)
> free'd
> 
> I think that a check in src/shared/shell.c might be better (and would
> avoid having to fix the bug in 6 other places). Something like this?
> 
> --- a/src/shared/shell.c
> +++ b/src/shared/shell.c
> @@ -1122,6 +1122,9 @@ static char **menu_completion(const struct
> bt_shell_menu_entry *entry,
>  {
>         char **matches = NULL;
>  
> +       if (argc == 0)
> +               return NULL;
> +
>         for (; entry->cmd; entry++) {
>                 if (strcmp(entry->cmd, input_cmd))
>                         continue;
> @@ -1146,6 +1149,8 @@ static char **submenu_completion(const char
> *text, int argc, char *input_cmd)
>  
>         if (data.main != data.menu)
>                 return NULL;
> +       if (!input_cmd)
> +               return NULL;
>  
>         cmd = strrchr(input_cmd, '.');
>         if (!cmd)
> 
> Let me know if you want to send a v2 with the mentioned changes
> instead.
> 
> > 
> > Cheers
> > 
> > > ---
> > >  src/shared/shell.c | 18 ++++++++++--------
> > >  1 file changed, 10 insertions(+), 8 deletions(-)
> > > 
> > > diff --git a/src/shared/shell.c b/src/shared/shell.c
> > > index b061f8001..57bba0977 100644
> > > --- a/src/shared/shell.c
> > > +++ b/src/shared/shell.c
> > > @@ -1174,15 +1174,17 @@ static char **shell_completion(const char
> > > *text, int start, int end)
> > >   if (wordexp(rl_line_buffer, &w, WRDE_NOCMD))
> > >   return NULL;
> > >  
> > > - matches = menu_completion(default_menu.entries,
> > > text,
> > > - w.we_wordc,
> > > w.we_wordv[0]);
> > > - if (!matches) {
> > > - matches = menu_completion(data.menu-
> > > > entries, text,
> > > -
> > >  w.we_wordc,
> > > -
> > >  w.we_wordv
> > > [0]);
> > > - if (!matches)
> > > - matches = submenu_completion(text,
> > > w.we_wordc,
> > > + if (w.we_wordc != 0) {
> > > + matches =
> > > menu_completion(default_menu.entries, text,
> > > + w.we_wordc
> > > ,
> > > w.we_wordv[0]);
> > > + if (!matches) {
> > > + matches =
> > > menu_completion(data.menu-
> > > > entries, text,
> > > + w.
> > > we
> > > _wordc,
> > >   w.
> > > we
> > > _wordv[0]);
> > > + if (!matches)
> > > + matches =
> > > submenu_completion(text, w.we_wordc,
> > > + 
> > >  w.we_wordv[0]);
> > > + }
> > >   }
> > >  
> > >   wordfree(&w);

RE: shared/shell: Fix SIGSEGV on invalid input

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1671 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1069318

---Test result---

Test Summary:
CheckPatch                    PENDING   0.44 seconds
GitLint                       PENDING   0.42 seconds
BuildEll                      PASS      21.16 seconds
BluezMake                     PASS      643.79 seconds
MakeCheck                     PASS      18.66 seconds
MakeDistcheck                 PASS      250.30 seconds
CheckValgrind                 PASS      294.96 seconds
CheckSmatch                   WARNING   354.79 seconds
bluezmakeextell               PASS      183.27 seconds
IncrementalBuild              PENDING   0.33 seconds
ScanBuild                     PASS      1032.91 seconds

Details
##############################
Test: CheckPatch - PENDING
Desc: Run checkpatch.pl script
Output:

##############################
Test: GitLint - PENDING
Desc: Run gitlint
Output:

##############################
Test: CheckSmatch - WARNING
Desc: Run smatch tool with source
Output:
src/shared/shell.c: note: in included file (through /usr/include/readline/readline.h):src/shared/shell.c: note: in included file (through /usr/include/readline/readline.h):src/shared/shell.c: note: in included file (through /usr/include/readline/readline.h):
##############################
Test: IncrementalBuild - PENDING
Desc: Incremental build with the patches in the series
Output:



https://github.com/bluez/bluez/pull/1975/checks

---
Regards,
Linux Bluetooth