2011-08-25 17:33:08

by Lucas De Marchi

Subject: [PATCH] avrcp: do not get fd when not connected

---
audio/control.c | 4 +++-
1 files changed, 3 insertions(+), 1 deletions(-)

diff --git a/audio/control.c b/audio/control.c
index 882c9fb..9990b06 100644
--- a/audio/control.c
+++ b/audio/control.c
@@ -727,7 +727,7 @@ static int avctp_send_event(struct control *control, uint8_t id, void *data)
struct avrcp_header *avrcp = (void *) &buf[AVCTP_HEADER_LENGTH];
struct avrcp_spec_avc_pdu *pdu = (void *) &buf[AVCTP_HEADER_LENGTH +
AVRCP_HEADER_LENGTH];
- int sk = g_io_channel_unix_get_fd(control->io);
+ int sk;
uint16_t size;

if (control->state != AVCTP_STATE_CONNECTED)
@@ -783,6 +783,8 @@ static int avctp_send_event(struct control *control, uint8_t id, void *data)
size += AVCTP_HEADER_LENGTH + AVRCP_HEADER_LENGTH +
AVRCP_SPECAVCPDU_HEADER_LENGTH;

+ sk = g_io_channel_unix_get_fd(control->io);
+
if (write(sk, buf, size) < 0)
return -errno;

--
1.7.6

2011-08-30 12:54:50

by Johan Hedberg

Subject: Re: [PATCH] Fix fd usage when not connected

Hi Lucas,

On Fri, Aug 26, 2011, Lucas De Marchi wrote:
> When the avctp channel is not connected, we call
> g_io_channel_unix_get_fd() with a NULL pointer. Glib does not check the
> pointer before dereferencing it, causing bluetoothd to segv.
>
> Move the function call to the place it's actually needed, after the
> safety checks.
> ---
> audio/control.c | 4 +++-
> 1 files changed, 3 insertions(+), 1 deletions(-)

Applied. Thanks.

Johan

2011-08-26 12:06:00

by Lucas De Marchi

Subject: [PATCH] Fix fd usage when not connected

When the avctp channel is not connected, we call
g_io_channel_unix_get_fd() with a NULL pointer. Glib does not check the
pointer before dereferencing it, causing bluetoothd to segv.

Move the function call to the place it's actually needed, after the
safety checks.
---
audio/control.c | 4 +++-
1 files changed, 3 insertions(+), 1 deletions(-)

diff --git a/audio/control.c b/audio/control.c
index 882c9fb..9990b06 100644
--- a/audio/control.c
+++ b/audio/control.c
@@ -727,7 +727,7 @@ static int avctp_send_event(struct control *control, uint8_t id, void *data)
struct avrcp_header *avrcp = (void *) &buf[AVCTP_HEADER_LENGTH];
struct avrcp_spec_avc_pdu *pdu = (void *) &buf[AVCTP_HEADER_LENGTH +
AVRCP_HEADER_LENGTH];
- int sk = g_io_channel_unix_get_fd(control->io);
+ int sk;
uint16_t size;

if (control->state != AVCTP_STATE_CONNECTED)
@@ -783,6 +783,8 @@ static int avctp_send_event(struct control *control, uint8_t id, void *data)
size += AVCTP_HEADER_LENGTH + AVRCP_HEADER_LENGTH +
AVRCP_SPECAVCPDU_HEADER_LENGTH;

+ sk = g_io_channel_unix_get_fd(control->io);
+
if (write(sk, buf, size) < 0)
return -errno;

--
1.7.6.1

2011-08-26 07:27:14

by Luiz Augusto von Dentz

Subject: Re: [PATCH] avrcp: do not get fd when not connected

Hi Lucas,

On Thu, Aug 25, 2011 at 8:33 PM, Lucas De Marchi
<[email protected]> wrote:
> ---
> ?audio/control.c | ? ?4 +++-
> ?1 files changed, 3 insertions(+), 1 deletions(-)
>
> diff --git a/audio/control.c b/audio/control.c
> index 882c9fb..9990b06 100644
> --- a/audio/control.c
> +++ b/audio/control.c
> @@ -727,7 +727,7 @@ static int avctp_send_event(struct control *control, uint8_t id, void *data)
> ? ? ? ?struct avrcp_header *avrcp = (void *) &buf[AVCTP_HEADER_LENGTH];
> ? ? ? ?struct avrcp_spec_avc_pdu *pdu = (void *) &buf[AVCTP_HEADER_LENGTH +
> ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?AVRCP_HEADER_LENGTH];
> - ? ? ? int sk = g_io_channel_unix_get_fd(control->io);
> + ? ? ? int sk;
> ? ? ? ?uint16_t size;
>
> ? ? ? ?if (control->state != AVCTP_STATE_CONNECTED)
> @@ -783,6 +783,8 @@ static int avctp_send_event(struct control *control, uint8_t id, void *data)
> ? ? ? ?size += AVCTP_HEADER_LENGTH + AVRCP_HEADER_LENGTH +
> ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?AVRCP_SPECAVCPDU_HEADER_LENGTH;
>
> + ? ? ? sk = g_io_channel_unix_get_fd(control->io);
> +
> ? ? ? ?if (write(sk, buf, size) < 0)
> ? ? ? ? ? ? ? ?return -errno;
>
> --
> 1.7.6

This looks like a bug, in such case we usually use 'fix' in the
description. But the patch looks good.

--
Luiz Augusto von Dentz