2014-06-27 14:07:34

by Andrei Emeltchenko

Subject: [PATCH] android/health: Fix NULL dereference

From: Andrei Emeltchenko <[email protected]>

---
android/health.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/android/health.c b/android/health.c
index 5f86727..2dc35d4 100644
--- a/android/health.c
+++ b/android/health.c
@@ -1878,7 +1878,7 @@ static void channel_delete_cb(GError *gerr, gpointer data)

DBG("");

- if (!gerr) {
+ if (gerr) {
error("health: channel delete failed %s", gerr->message);
return;
}
--
1.8.3.2

2014-06-27 14:12:48

by Szymon Janc

Subject: Re: [PATCH] android/health: Fix NULL dereference

Hi Andrei,

On Friday 27 of June 2014 17:07:34 Andrei Emeltchenko wrote:
> From: Andrei Emeltchenko <[email protected]>
>
> ---
> android/health.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/android/health.c b/android/health.c
> index 5f86727..2dc35d4 100644
> --- a/android/health.c
> +++ b/android/health.c
> @@ -1878,7 +1878,7 @@ static void channel_delete_cb(GError *gerr, gpointer data)
>
> DBG("");
>
> - if (!gerr) {
> + if (gerr) {
> error("health: channel delete failed %s", gerr->message);
> return;
> }
>

Applied, thanks.

--
Best regards,
Szymon Janc

2014-08-20 10:02:41

by Szymon Janc

Subject: Re: [PATCH] android/health: Fix NULL dereference

Hi Andrei,

On Wednesday 20 of August 2014 10:02:03 Andrei Emeltchenko wrote:
> From: Andrei Emeltchenko <[email protected]>
>
> In a case get_app(), get_device(), get_channel() fail prevent
> dereference of NULL pointer. Fixes clang warnings:
> ...
> android/health.c:1980:15: warning: Access to field 'dev' results in a
> dereference of a null pointer (loaded from variable 'channel')
> queue_remove(channel->dev->channels, channel);
> ^~~~~~~~~~~~
> 1 warning generated.
> ...
> ---
> android/health.c | 8 +++++---
> 1 file changed, 5 insertions(+), 3 deletions(-)
>
> diff --git a/android/health.c b/android/health.c
> index c8af90e..665482e 100644
> --- a/android/health.c
> +++ b/android/health.c
> @@ -1931,15 +1931,15 @@ static void bt_health_connect_channel(const void
> *buf, uint16_t len)
>
> app = get_app(cmd->app_id);
> if (!app)
> - goto fail;
> + goto send_rsp;
>
> dev = get_device(app, cmd->bdaddr);
> if (!dev)
> - goto fail;
> + goto send_rsp;
>
> channel = get_channel(app, cmd->mdep_index, dev);
> if (!channel)
> - goto fail;
> + goto send_rsp;
>
> if (!queue_length(dev->channels)) {
> if (channel->type != CHANNEL_TYPE_RELIABLE) {
> @@ -1979,6 +1979,8 @@ static void bt_health_connect_channel(const void *buf,
> uint16_t len) fail:
> queue_remove(channel->dev->channels, channel);
> free_health_channel(channel);
> +
> +send_rsp:
> ipc_send_rsp(hal_ipc, HAL_SERVICE_ID_HEALTH,
> HAL_OP_HEALTH_CONNECT_CHANNEL, HAL_STATUS_FAILED);
> }

Applied, thanks.

--
BR
Szymon Janc