[PATCH BlueZ v1] iso-tester: Fix crashing while attemping to access isodata

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



From: Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>

Some tests may not set any isodata causing the following crash:

Invalid read of size 1
   at 0x40067A8: setup_powered_callback (iso-tester.c:1691)
   by 0x40232D5: request_complete (mgmt.c:306)
   by 0x40242B3: can_read_data (mgmt.c:394)
   by 0x4028529: watch_callback (io-glib.c:173)
   by 0x493D87F: ??? (in /usr/lib64/libglib-2.0.so.0.8400.2)
   by 0x49467A7: ??? (in /usr/lib64/libglib-2.0.so.0.8400.2)
   by 0x4946A4E: g_main_loop_run (in /usr/lib64/libglib-2.0.so.0.8400.2)
   by 0x402ABFD: mainloop_run (mainloop-glib.c:65)
   by 0x402B1D4: mainloop_run_with_signal (mainloop-notify.c:196)
   by 0x402A3F5: tester_run (tester.c:1076)
   by 0x40050FE: main (iso-tester.c:4010)
 Address 0xa8 is not stack'd, malloc'd or (recently) free'd
---
 tools/iso-tester.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/tools/iso-tester.c b/tools/iso-tester.c
index 725fd3338c9f..56550882ea63 100644
--- a/tools/iso-tester.c
+++ b/tools/iso-tester.c
@@ -1683,13 +1683,17 @@ static void setup_powered_callback(uint8_t status, uint16_t length,
 	for (i = 0; i < data->client_num; i++) {
 		struct hciemu_client *client;
 		struct bthost *host;
+		uint8_t sid = 0;
 
 		client = hciemu_get_client(data->hciemu, i);
 		host = hciemu_client_host(client);
 		bthost_set_cmd_complete_cb(host, client_connectable_complete,
 									data);
-		bthost_set_ext_adv_params(host, isodata->sid != 0xff ?
-						isodata->sid : 0x00);
+
+		if (isodata)
+			sid = isodata->sid;
+
+		bthost_set_ext_adv_params(host, sid != 0xff ? sid : 0x00);
 		bthost_set_ext_adv_enable(host, 0x01);
 
 		if (!isodata)
@@ -1903,7 +1907,7 @@ static int create_iso_sock(struct test_data *data)
 		addr->iso_family = AF_BLUETOOTH;
 		bacpy(&addr->iso_bdaddr, (void *) master_bdaddr);
 		addr->iso_bdaddr_type = BDADDR_LE_PUBLIC;
-		err = bind(sk, (struct sockaddr *) addr, sizeof(addr));
+		err = bind(sk, (struct sockaddr *) addr, sizeof(*addr));
 	}
 
 	if (err < 0) {
-- 
2.49.0





[Index of Archives]     [Bluez Devel]     [Linux Wireless Networking]     [Linux Wireless Personal Area Networking]     [Linux ATH6KL]     [Linux USB Devel]     [Linux Media Drivers]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Big List of Linux Books]

  Powered by Linux