Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) client-ip=2620:137:e000::1:18;
MIME-Version: 1.0
References: <20220325092706.17135-1-frederic.danis@collabora.com>
In-Reply-To: <20220325092706.17135-1-frederic.danis@collabora.com>
From:   Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Date:   Fri, 25 Mar 2022 13:06:00 -0700
Message-ID: <CABBYNZJJAN7GeNRm8_UyyE4pBDKn+YWLiqHBxecKcKUJhzDbTQ@mail.gmail.com>
Subject: Re: [PATCH] a2dp: Fix crash when SEP codec has not been initialized
To:     =?UTF-8?B?RnLDqWTDqXJpYyBEYW5pcw==?= <frederic.danis@collabora.com>
Cc:     "linux-bluetooth@vger.kernel.org" <linux-bluetooth@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

Hi Fr=C3=A9d=C3=A9ric,

On Fri, Mar 25, 2022 at 12:53 PM Fr=C3=A9d=C3=A9ric Danis
<frederic.danis@collabora.com> wrote:
>
> If SEP has not been properly discovered avdtp_get_codec may return NULL
> thus causing crashes such as when running AVRCP/TG/VLH/BI-01-C after
> AVRCP/TG/RCR/BV-04-C
> ---
>  profiles/audio/a2dp.c | 17 ++++++++++++++---
>  1 file changed, 14 insertions(+), 3 deletions(-)
>
> diff --git a/profiles/audio/a2dp.c b/profiles/audio/a2dp.c
> index f761dbe54..7da008071 100644
> --- a/profiles/audio/a2dp.c
> +++ b/profiles/audio/a2dp.c
> @@ -1995,7 +1995,12 @@ static gboolean get_codec(const GDBusPropertyTable=
 *property,
>  {
>         struct a2dp_remote_sep *sep =3D data;
>         struct avdtp_service_capability *cap =3D avdtp_get_codec(sep->sep=
);
> -       struct avdtp_media_codec_capability *codec =3D (void *) cap->data=
;
> +       struct avdtp_media_codec_capability *codec;
> +
> +       if (!cap)
> +               return FALSE;
> +
> +       codec =3D (void *) cap->data;
>
>         dbus_message_iter_append_basic(iter, DBUS_TYPE_BYTE,
>                                                 &codec->media_codec_type)=
;
> @@ -2008,10 +2013,16 @@ static gboolean get_capabilities(const GDBusPrope=
rtyTable *property,
>  {
>         struct a2dp_remote_sep *sep =3D data;
>         struct avdtp_service_capability *service =3D avdtp_get_codec(sep-=
>sep);
> -       struct avdtp_media_codec_capability *codec =3D (void *) service->=
data;
> -       uint8_t *caps =3D codec->data;
> +       struct avdtp_media_codec_capability *codec;
> +       uint8_t *caps;
>         DBusMessageIter array;
>
> +       if (!service)
> +               return FALSE;
> +
> +       codec =3D (void *) service->data;
> +       caps =3D codec->data;
> +
>         dbus_message_iter_open_container(iter, DBUS_TYPE_ARRAY,
>                                         DBUS_TYPE_BYTE_AS_STRING, &array)=
;
>
> --
> 2.25.1

We should either have a .exist callback or not have the endpoint
registered if its codec is not available, I'm leaning toward the
latter given that it is useless to have the endpoint if it cannot be
used without the codec information.


--=20
Luiz Augusto von Dentz