2021-11-10 15:48:33

by Jay Foster

Subject: BlueZ hciconfig: Segmentation Fault

From: Jay Foster <[email protected]>

hciconfig segfaults in the Bluez 5.62 release.

The 'hciconfig lm' command, used to show the current link mode settings,
de-references a NULL pointer when calling strcasestr().  This results in
a segmentation fault.  This is a regression in release 5.62 from the updates
to implement the appropriate language changes.

The hci_str2bit() function handles a NULL str value, but strcasestr()
does not.

Signed-off-by: Jay Foster <[email protected]>

--- a/lib/hci.c    2021-10-13 11:38:34.000000000 -0700
+++ b/lib/hci.c    2021-11-08 09:19:59.880207913 -0800
@@ -323,7 +323,7 @@ int hci_strtolm(char *str, unsigned int
     int ret = hci_str2bit(link_mode_map, str, val);

     /* Deprecated name. Kept for compatibility. */
-    if (strcasestr(str, "MASTER")) {
+    if (str && strcasestr(str, "MASTER")) {
         ret = 1;
         *val |= HCI_LM_MASTER;
     }

2021-11-11 00:29:29

by Luiz Augusto von Dentz

Subject: Re: BlueZ hciconfig: Segmentation Fault

Hi Jay,

On Wed, Nov 10, 2021 at 7:47 AM Jay Foster <[email protected]> wrote:
>
> From: Jay Foster <[email protected]>
>
> hciconfig segfaults in the Bluez 5.62 release.
>
> The 'hciconfig lm' command, used to show the current link mode settings,
> de-references a NULL pointer when calling strcasestr(). This results in
> a segmentation fault. This is a regression in release 5.62 from the updates
> to implement the appropriate language changes.
>
> The hci_str2bit() function handles a NULL str value, but strcasestr()
> does not.
>
> Signed-off-by: Jay Foster <[email protected]>
>
> --- a/lib/hci.c 2021-10-13 11:38:34.000000000 -0700
> +++ b/lib/hci.c 2021-11-08 09:19:59.880207913 -0800
> @@ -323,7 +323,7 @@ int hci_strtolm(char *str, unsigned int
> int ret = hci_str2bit(link_mode_map, str, val);
>
> /* Deprecated name. Kept for compatibility. */
> - if (strcasestr(str, "MASTER")) {
> + if (str && strcasestr(str, "MASTER")) {
> ret = 1;
> *val |= HCI_LM_MASTER;
> }

You will probably need to rebase:

Applying: BlueZ hciconfig: Segmentation Fault
error: lib/hci.c 2021-11-08 09:19:59.880207913 -0800: does not exist in index
Patch failed at 0001 BlueZ hciconfig: Segmentation Fault


--
Luiz Augusto von Dentz

2021-11-11 15:39:04

by Jay Foster

Subject: Re: BlueZ hciconfig: Segmentation Fault

On 11/10/2021 4:29 PM, Luiz Augusto von Dentz wrote:
> Hi Jay,
>
> On Wed, Nov 10, 2021 at 7:47 AM Jay Foster <[email protected]> wrote:
>> From: Jay Foster <[email protected]>
>>
>> hciconfig segfaults in the Bluez 5.62 release.
>>
>> The 'hciconfig lm' command, used to show the current link mode settings,
>> de-references a NULL pointer when calling strcasestr(). This results in
>> a segmentation fault. This is a regression in release 5.62 from the updates
>> to implement the appropriate language changes.
>>
>> The hci_str2bit() function handles a NULL str value, but strcasestr()
>> does not.
>>
>> Signed-off-by: Jay Foster <[email protected]>
>>
>> --- a/lib/hci.c 2021-10-13 11:38:34.000000000 -0700
>> +++ b/lib/hci.c 2021-11-08 09:19:59.880207913 -0800
>> @@ -323,7 +323,7 @@ int hci_strtolm(char *str, unsigned int
>> int ret = hci_str2bit(link_mode_map, str, val);
>>
>> /* Deprecated name. Kept for compatibility. */
>> - if (strcasestr(str, "MASTER")) {
>> + if (str && strcasestr(str, "MASTER")) {
>> ret = 1;
>> *val |= HCI_LM_MASTER;
>> }
> You will probably need to rebase:
>
> Applying: BlueZ hciconfig: Segmentation Fault
> error: lib/hci.c 2021-11-08 09:19:59.880207913 -0800: does not exist in index
> Patch failed at 0001 BlueZ hciconfig: Segmentation Fault
>
>
Regenerated patch using git.
From: Jay Foster <[email protected]>

hciconfig segfaults in the Bluez 5.62 release.

The 'hciconfig lm' command, used to show the current link mode settings,
de-references a NULL pointer when calling strcasestr().  This results in
a segmentation fault.  This is a regression in release 5.62 from the updates
to implement the appropriate language changes.

The hci_str2bit() function handles a NULL str value, but strcasestr()
does not.

Signed-off-by: Jay Foster <[email protected]>

diff --git a/lib/hci.c b/lib/hci.c
index 5141f20..0436759 100644
--- a/lib/hci.c
+++ b/lib/hci.c
@@ -323,7 +323,7 @@ int hci_strtolm(char *str, unsigned int *val)
     int ret = hci_str2bit(link_mode_map, str, val);

     /* Deprecated name. Kept for compatibility. */
-    if (strcasestr(str, "MASTER")) {
+    if (str && strcasestr(str, "MASTER")) {
         ret = 1;
         *val |= HCI_LM_MASTER;
     }