Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Mon, 14 Feb 2022 17:13:43 +0800
Message-Id: <20220214171329.Bluez.v1.1.I8c72b5af2506378bba6da369228ae50483231e35@changeid>
Mime-Version: 1.0
Subject: [Bluez PATCH v1] lib: fix hci_strtolm crash
From:   Howard Chung <howardchung@google.com>
To:     linux-bluetooth@vger.kernel.org, luiz.dentz@gmail.com
Cc:     Yun-Hao Chung <howardchung@chromium.org>,
        Archie Pusaka <apusaka@chromium.org>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

From: Yun-Hao Chung <howardchung@chromium.org>

|str| can be NULL in the case of reading lm value. Calling strcasestr
could lead to a crash.

Reviewed-by: Archie Pusaka <apusaka@chromium.org>
---
Verified by running "hciconfig hci0 lm" on hatch

 lib/hci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/hci.c b/lib/hci.c
index 5141f20ac..5228c2ad2 100644
--- a/lib/hci.c
+++ b/lib/hci.c
@@ -323,7 +323,7 @@ int hci_strtolm(char *str, unsigned int *val)
 	int ret = hci_str2bit(link_mode_map, str, val);
 
 	/* Deprecated name. Kept for compatibility. */
-	if (strcasestr(str, "MASTER")) {
+	if (!!str && strcasestr(str, "MASTER")) {
 		ret = 1;
 		*val |= HCI_LM_MASTER;
 	}
-- 
2.35.1.265.g69c8d7142f-goog