Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Iulia Tanasescu <iulia.tanasescu@nxp.com>
To:     linux-bluetooth@vger.kernel.org
Cc:     claudia.rosu@nxp.com, silviu.barbulescu@nxp.com,
        andrei.istodorescu@nxp.com, mihai-octavian.urzica@nxp.com,
        vlad.pruteanu@nxp.com, Iulia Tanasescu <iulia.tanasescu@nxp.com>
Subject: [PATCH BlueZ 1/2] gatt-server: Check pointer before memcpy
Date:   Tue, 13 Jun 2023 17:16:24 +0300
Message-Id: <20230613141625.9197-2-iulia.tanasescu@nxp.com>
In-Reply-To: <20230613141625.9197-1-iulia.tanasescu@nxp.com>
References: <20230613141625.9197-1-iulia.tanasescu@nxp.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?yxkYIJLLJxyQsHX3nzhUcbCAjuRPYwyDUjq/uaggSZUClLl9HYb/8lPPtbD+?=
 =?us-ascii?Q?rw9LyzqqIbUd6aA2lyJnT1//NnR7xH3cpPGLRbD4ne5Ab5TB5ScSVqTaq+Yq?=
 =?us-ascii?Q?X6hk0CjDV2DKk3XQ+lwrjDW8J259BDMzyiUXCYLb+nkR+WugTksHrG/wbsvk?=
 =?us-ascii?Q?76kCis2g26y4etfhPRyw36CFWHyHdFZRk6oI9p9LaizNWEW9rlbK9opEW332?=
 =?us-ascii?Q?yCZhMv7nlmrKW7c3cXP9l3Bzt9Tl6osoYElNukBaTxs82yVAw4uRhWuGayIL?=
 =?us-ascii?Q?GNds05Bsn97K4oHFgZZwqq6mTQjzOHVv/aDEK1U0ulURNC6/823TBdds+Lvm?=
 =?us-ascii?Q?ullFMxR2nZzfbb+AbtB4zlbX3bbFjbBTqlKRljQhr3GxEGEd1IdGtK05hpHr?=
 =?us-ascii?Q?Om4HpLWN24OJhJ8z/i8WmyEUBTaDIZlNqxMIoil4nd0z+J4NlYO2/5EnqBmW?=
 =?us-ascii?Q?Rff21TXO1gmmYbrCbXDWqM9o8FAQnCCT/iC+8Fu4WerC3pz8PZEWnqtzLD1x?=
 =?us-ascii?Q?zkBA2cocoWYDAKonFzVP50Mr8O6rQk/KZmHvk/oGRMEcgdmZf5xTFaavBcok?=
 =?us-ascii?Q?xyY1+CGN093ZXDnsKIzyt60EuMWJ9UP13irEQGeBQKf91cXmRta9gT88GLig?=
 =?us-ascii?Q?bySIhvay5DhewCy7G1laDL0bj2XeT+unTj2yFSsWhWjcGji/GQnqGJeIH51Z?=
 =?us-ascii?Q?cSEN+W7oc+9y9NVRfRM7ikGhqcHIPMHyluxUON2UNTeBAltw3wcxuaI2h6bz?=
 =?us-ascii?Q?PvFKK1Y1c0lALE0Ii9jmpG4Z8dK5Ya33qrVixWIqXXTySIvAmUuRPqlRiiu9?=
 =?us-ascii?Q?UTFiBFIfHzsp4zBASldMkZTF2ZW3Tajkf1CwsTR08PWMEYcZAf+xQds5aEYG?=
 =?us-ascii?Q?A20WWgFry8C3cJXaDBVwhnZ9gZHHYd8kEllAG8NMiOW4T00c4UrlLvLF9VFi?=
 =?us-ascii?Q?rshIu9Sm/oq7c5R+49wOxFzl1Q53LRTC1AsxrHo3A9p3KIu1i4e2beOouluK?=
 =?us-ascii?Q?gjt7mydftQetUXV2IzY6oLx8ATVq1+FEICqRXEh3KwU4A88oT1bsQqBBR7zR?=
 =?us-ascii?Q?T9lMjmKYokNAjtVATWw7NV4i/zFsHlG48cWzXKYgWgodeUDSB8KWvoHHw6Rk?=
 =?us-ascii?Q?d0apI8/Fu1A7PuD1b8kMTwKDTLMYrGHHmYvZQDy3KXfTRD6v3wFbFCDguqx9?=
 =?us-ascii?Q?RNayTaKpNskuhIaoh+FiPgsGBox8HFY2q5LpH99IYhjPsvBvrZuB4TdtTC5X?=
 =?us-ascii?Q?juxWF+ZpPASf/FFiPKAMqrQURqwPhlk81VEWoY14bH72zpywojf85/ifgr15?=
 =?us-ascii?Q?7BfkdpuJxv5bKSFb2699jCcpXdqFDdRL+JYFvRe6nWcCisXtIw8/v4PplHog?=
 =?us-ascii?Q?a/ErgLMm5f7ANRNmh5IDCR71FW6fu/vGjDIpF/DrwoWNRQ+YXTt/iiovG+32?=
 =?us-ascii?Q?30wK1FYGyrdDm2XycLEIBM2CO+sYXyaHlBywq0IarfJQxEP14vO75lDmw9aq?=
 =?us-ascii?Q?/UDUSiX/sNvpEkhlW3i0044UBQEc6jsXCSjnd6n99Jj5cZWfrFXsmcGhb1v5?=
 =?us-ascii?Q?B1Jx28l5I7A+ygUz3N/bAhzgeRz26lFj96oPQrLUCjLwrXInC+AtdaWBGSVd?=
 =?us-ascii?Q?Gw=3D=3D?=
X-OriginatorOrg: nxp.com
X-MS-Exchange-CrossTenant-Network-Message-Id: b9b9f940-2466-4be2-9a08-08db6c18e527
X-MS-Exchange-CrossTenant-AuthSource: AS8PR04MB8898.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Jun 2023 14:17:18.3955
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: k/YSWqTMKvJMg+WHM80V0vBUtPZADhpNDc8DvgI7qJxivXG3UHUYy7ImWKfT4n3l2UX5cXZv3v2rhyeNRoEbMA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: VE1PR04MB7213
X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE,
        RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS,T_SCC_BODY_TEXT_LINE,
        URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-bluetooth.vger.kernel.org>
X-Mailing-List: linux-bluetooth@vger.kernel.org

This adds a check before calling memcpy inside
bt_gatt_server_send_notification, to avoid getting
the following error in case the user wants to send
an empty notification for an attribute:

src/shared/gatt-server.c:1789:3: runtime error:
null pointer passed as argument 2, which is declared to never be null

---
 src/shared/gatt-server.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/shared/gatt-server.c b/src/shared/gatt-server.c
index 85cff30ec..0512d06f6 100644
--- a/src/shared/gatt-server.c
+++ b/src/shared/gatt-server.c
@@ -4,6 +4,7 @@
  *  BlueZ - Bluetooth protocol stack for Linux
  *
  *  Copyright (C) 2014  Google Inc.
+ *  Copyright 2023 NXP
  *
  *
  */
@@ -1785,7 +1786,9 @@ bool bt_gatt_server_send_notification(struct bt_gatt_server *server,
 		length = MIN(data->len - data->offset, length);
 	}
 
-	memcpy(data->pdu + data->offset, value, length);
+	if (value)
+		memcpy(data->pdu + data->offset, value, length);
+
 	data->offset += length;
 
 	if (multiple) {
-- 
2.34.1