2014-12-19 12:30:28

by Andrei Emeltchenko

Subject: [PATCH] android/gatt: Fix possible NULL dereference

From: Andrei Emeltchenko <[email protected]>

Fixes warnings:
...
Pointer 'req' returned from call to function 'queue_peek_head'
may be NULL and will be dereferenced
...
---
android/gatt.c | 3 +++
1 file changed, 3 insertions(+)

diff --git a/android/gatt.c b/android/gatt.c
index 6828f2f..2534836 100644
--- a/android/gatt.c
+++ b/android/gatt.c
@@ -5561,6 +5561,9 @@ static void handle_server_send_response(const void *buf, uint16_t len)
* gatt_db_attribute_write().
*/
req = queue_peek_head(conn->device->pending_requests);
+ if (!req)
+ goto done;
+
/* Cast status to uint8_t, due to (byte) cast in java layer. */
req->error = err_to_att((uint8_t) cmd->status);
req->state = REQUEST_DONE;
--
2.1.0

2014-12-19 13:10:06

by Szymon Janc

Subject: Re: [PATCH] android/gatt: Fix possible NULL dereference

Hi Andrei,

On Friday 19 of December 2014 14:30:28 Andrei Emeltchenko wrote:
> From: Andrei Emeltchenko <[email protected]>
>
> Fixes warnings:
> ...
> Pointer 'req' returned from call to function 'queue_peek_head'
> may be NULL and will be dereferenced
> ...
> ---
> android/gatt.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/android/gatt.c b/android/gatt.c
> index 6828f2f..2534836 100644
> --- a/android/gatt.c
> +++ b/android/gatt.c
> @@ -5561,6 +5561,9 @@ static void handle_server_send_response(const void *buf, uint16_t len)
> * gatt_db_attribute_write().
> */
> req = queue_peek_head(conn->device->pending_requests);
> + if (!req)
> + goto done;
> +
> /* Cast status to uint8_t, due to (byte) cast in java layer. */
> req->error = err_to_att((uint8_t) cmd->status);
> req->state = REQUEST_DONE;
>

Patch applied, thanks.

--
Best regards,
Szymon Janc