* [PATCH BlueZ 1/1] mpris-proxy: Fix possible crash on OBEX transfer
2026-11-06 8:05 [PATCH BlueZ 0/1] mpris-proxy: Fix possible crash on OBEX transfer Kai-Chuan Hsieh
@ 2026-11-06 8:05 ` Kai-Chuan Hsieh
2026-11-06 10:47 ` bluez.test.bot
0 siblings, 1 reply; 3+ messages in thread
From: Kai-Chuan Hsieh @ 2026-11-06 8:05 UTC (permalink / raw)
To: linux-bluetooth; +Cc: Luiz Augusto von Dentz, Bastien Nocera
find_player_by_obex() and related helpers dereference player->obex and
its inner ->obex proxy without checking for NULL. A player legitimately
carries no OBEX session (player->obex == NULL) in three ordinary cases
and stays on the players list in each:
- register_player(): the remote exposes no ObexPort (no AVRCP cover
art);
- device_property_changed(): the device disconnected;
- obex_proxy_removed(): obexd went away.
find_player_by_obex() is reached from obex_property_changed() on every
Status change of any org.bluez.obex.Transfer1 object. Because
g_dbus_client_new() roots the OBEX client at "/", mpris-proxy proxies
all of obexd's objects, including the server-side transfers obexd
registers at /org/bluez/obex/server/sessionN/transferM for an incoming
push. Those paths never belong to a player; walking the list faults on
the first player whose session is NULL. So any peer pushing a file over
OBEX crashes mpris-proxy as soon as one registered player lacks a
cover-art session (the common configuration).
In addition, connect_obex_session() can leave session->obex NULL after a
failed CreateSession. In that state a Track change carrying an ImgHandle
reaches obex_get_image(), where g_dbus_proxy_get_path(NULL) returns NULL
and "path + strlen(...)" forms a garbage pointer passed to
g_strconcat(), crashing the process.
Guard all four player->obex / session->obex dereference sites, and use
g_clear_pointer() when releasing session->obex so a stale pointer cannot
be reused.
This folds together the fix originally proposed by Bastien Nocera in
https://github.com/bluez/bluez/pull/2098 and the additional inner-proxy
guard tracked in https://github.com/bluez/bluez/issues/2569 and
https://github.com/bluez/bluez/pull/2631, neither of which landed.
Signed-off-by: Kai-Chuan Hsieh <kaichuan.hsieh@canonical.com>
---
tools/mpris-proxy.c | 20 ++++++++++++++++----
1 file changed, 16 insertions(+), 4 deletions(-)
diff --git a/tools/mpris-proxy.c b/tools/mpris-proxy.c
index e06b9ea..8547fa9 100644
--- a/tools/mpris-proxy.c
+++ b/tools/mpris-proxy.c
@@ -1306,7 +1306,7 @@ static int parse_track_entry(DBusMessageIter *entry, const char *key,
const char *handle, *path;
char *filename, *uri;
- if (!player || !player->obex)
+ if (!player || !player->obex || !player->obex->obex)
return -EINVAL;
path = g_dbus_proxy_get_path(player->obex->obex);
@@ -2614,9 +2614,14 @@ static void obex_get_image(struct player *player, const char *handle)
DBusMessage *msg;
DBusMessageIter iter, array;
struct obex_session *obex_session = player->obex;
- const char *path = g_dbus_proxy_get_path(obex_session->obex);
+ const char *path;
char *filename;
+ if (!obex_session || !obex_session->obex)
+ return;
+
+ path = g_dbus_proxy_get_path(obex_session->obex);
+
player->filename = g_strconcat(g_get_tmp_dir(), "/",
path + strlen(BLUEZ_OBEX_CLIENT_PATH "/"),
"-", handle, NULL);
@@ -2674,7 +2679,7 @@ static void device_property_changed(GDBusProxy *proxy, const char *name,
player->obex = NULL;
}
- g_dbus_proxy_unref(session->obex);
+ g_clear_pointer(&session->obex, g_dbus_proxy_unref);
g_dbus_proxy_unref(session->device);
obex_sessions = g_slist_remove(obex_sessions, session);
g_free(session);
@@ -2816,7 +2821,14 @@ static struct player *find_player_by_obex(const char *path)
for (l = players; l; l = l->next) {
struct player *player = l->data;
struct obex_session *session = player->obex;
- const char *obex_path = g_dbus_proxy_get_path(session->obex);
+ const char *obex_path;
+
+ if (session == NULL || session->obex == NULL)
+ continue;
+
+ obex_path = g_dbus_proxy_get_path(session->obex);
+ if (obex_path == NULL)
+ continue;
if (g_str_has_prefix(path, obex_path))
return player;
--
2.43.0
^ permalink raw reply related [flat|nested] 3+ messages in thread