2012-01-24 12:29:50

by Slawomir Bochenski

Subject: bluez static analysis: plugins/hciops.c:init_adapter()

In file plugins/hciops.c in function init_adapter(), at line 658,
there is following fragment:

if (!dev->registered) {
adapter = btd_manager_register_adapter(index);
if (adapter)
dev->registered = TRUE;
} else {
adapter = manager_find_adapter(&dev->bdaddr);
/* FIXME: manager_find_adapter should return a new ref */
btd_adapter_ref(adapter);
}

if (adapter == NULL)
return FALSE;

btd_adapter_ref() directly dereferences adapter. In all other calls of
manager_find_adapter() in BlueZ code, returned value is checked for
NULL before any use.

Is it guaranteed here that manager_find_adapter() won't return NULL?

--
Slawomir Bochenski

2012-02-03 21:25:50

by Johan Hedberg

Subject: Re: bluez static analysis: plugins/hciops.c:init_adapter()

Hi Slawek,

On Tue, Jan 24, 2012, Slawomir Bochenski wrote:
> In file plugins/hciops.c in function init_adapter(), at line 658,
> there is following fragment:
>
> if (!dev->registered) {
> adapter = btd_manager_register_adapter(index);
> if (adapter)
> dev->registered = TRUE;
> } else {
> adapter = manager_find_adapter(&dev->bdaddr);
> /* FIXME: manager_find_adapter should return a new ref */
> btd_adapter_ref(adapter);
> }
>
> if (adapter == NULL)
> return FALSE;
>
> btd_adapter_ref() directly dereferences adapter. In all other calls of
> manager_find_adapter() in BlueZ code, returned value is checked for
> NULL before any use.
>
> Is it guaranteed here that manager_find_adapter() won't return NULL?

In general a function called "find" can obviously return NULL even
though in this case it should be in practice impossible. For consistency
the check should be there though. Please send a patch.

Johan