Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Nitin Jadhav <nitin.jadhav@nxp.com>
To:     linux-bluetooth@vger.kernel.org
Cc:     devyani.godbole@nxp.com, pav@iki.fi, luiz.dentz@gmail.com,
        sathish.narasimman@intel.com, nitin.jadhav@nxp.com
Subject: [PATCH BlueZ v3 2/3] shared/vcp: Fixed issues related to read audio location and descriptor
Date:   Tue, 25 Jul 2023 14:21:25 +0300
Message-Id: <20230725112126.49656-3-nitin.jadhav@nxp.com>
In-Reply-To: <20230725112126.49656-1-nitin.jadhav@nxp.com>
References: <20230725112126.49656-1-nitin.jadhav@nxp.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?hpUcDeMYSN54154iOOjhVlpMjRQPKYaJdW8nsSM38arxTNwkMKf0g/5/D9Vr?=
 =?us-ascii?Q?Z/kMX0cGtEdW+98aRSSAoysijB7bgTflU9p+z2yGgGmrC0C7psJ2n9Q32IyB?=
 =?us-ascii?Q?vIpc/zbTqRzG2lHqgEIshtFC+Erel6bIjdWy2PncH04iYHdK85Q4LXNSK3VE?=
 =?us-ascii?Q?ALz4upDOk88xDZygNwm40JuAwLlZdldKUkZCOfhXlO3e6VBG3/ezOuy39AIS?=
 =?us-ascii?Q?Sa5XBnJYDnVyZFnNOhxSiq9W+pnw/cDCyRi4jO6aZzrz3A31/jt/G9at9lfg?=
 =?us-ascii?Q?ruiXAzWVRfHXKMoq/fYaZBcO57O8O1yDEWgdafe3FejoWWt5dvnlzb7kNQoZ?=
 =?us-ascii?Q?SOYfCbf78D3Q3b9pok2PnwBkW21fxlfh56wl0E8610bIqYGZHHjnuXAf2KaC?=
 =?us-ascii?Q?rLBLfnccJ7ziPxWWIBYuBCyORBvzTI3gVn080pL2WrhRz+ef7hbKnabuTVdl?=
 =?us-ascii?Q?K8rqG1V/zZn3K2RlDOerRArfc0k6TKll5t0Otl5sNqo2R5iIkS/MNes8B9pN?=
 =?us-ascii?Q?bmQ0NmiaLAz2T88m0H76nEDo8uaGWOL1ydxkQ9Cw8aojR4lJK+r5wZ9BzVH4?=
 =?us-ascii?Q?xHa4n6NgBIcMS2PYqxDGAYno1uoAAkvv2Q8BVymfYmXiLE/NhcvvFLFPEZcM?=
 =?us-ascii?Q?znTgwOoJloDKyDNEA31EktTxddWdP1VPstfxEljmhCmxBOfl45Rgyu+fn/JO?=
 =?us-ascii?Q?IGpGYsZCpqD0Mtt4zLA8X/pQkRAh9jgGRpdyXxxJFl4tOoHLEo3TUj5v2lTA?=
 =?us-ascii?Q?Ovsqz06/rq5YMrAhezBiIlnbpwsQeYsmpaWIrNb/6IToD0brT7RmtkfpToyU?=
 =?us-ascii?Q?m3BoU48jQp2maDelN54s4h7fxwn0MCjdFUNuekLgQz8zYYu3Yw+wq7Wha//V?=
 =?us-ascii?Q?1IgAe9sZlmVx7wMc1AjX+qmQH5zd9Ga730QQ3AmNUQH26dPTfh+aJ+JRdScS?=
 =?us-ascii?Q?1YS/O2yYmg9K7oamF3ZBJPSOlhGP5xWtayH7BT8RblSqoGr99CZkBVVe0eIY?=
 =?us-ascii?Q?og31l32xVYMSYEatTdtfg8I2eOlhyDvCJ+Unh1vf0rZizsSUhddf0A1Xjg21?=
 =?us-ascii?Q?7BvzEJqFPS+6JMALEnbtE5C4rM5Jgvk/BWE8uxen3YKD7rPk+FTpWdxO3R7w?=
 =?us-ascii?Q?C5RIqsj7VlO0HorPUqMuFMgKznvELPHFwWxrB3YcF7V9FeeEbUkN5J2hQqDS?=
 =?us-ascii?Q?/BK67TAV+XLHmqxLj9ZnqG6PQxQBcQE13WUjelUI+GMFI2lEv+tZqwyKIdKJ?=
 =?us-ascii?Q?qbkans8okl1JyEo1JBK5JFBWBWdtbzhahxuWMHHV23Zf+GENzbVOipxSEAr8?=
 =?us-ascii?Q?e/GjyYdGtqpBZ1e9yjrEs1PVqZur++oAsByWYaoPmCRsIb1Qiqai7ntEEgoo?=
 =?us-ascii?Q?houMq8ltDxkim9djbkuspa3WRFhR2O7jbBMsnDjoMiNi9ct0Ije/dRSwLgVq?=
 =?us-ascii?Q?ncO2YJW1g0YgZL/3s5/FN/kxOCZmO9VNossgLNkHb/gFCbTm2VYvaMcmbhD2?=
 =?us-ascii?Q?ZhNY80Ad/fyOwOR/BBLMAq/FjI8VafMUVNist01BPEWoyT4OvWDYyUJTDQ3B?=
 =?us-ascii?Q?zj80E/SMTaq0mDQesG22QRcfn23qv8e2snRSrZrd?=
X-OriginatorOrg: nxp.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 3ed5eeb8-7cce-4ab2-1293-08db8d016563
X-MS-Exchange-CrossTenant-AuthSource: AS8PR04MB9126.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Jul 2023 11:22:13.9425
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: UEJET26YjuHWFR0SJ9SzN/Lx/32HqkW78Panvj0Ttbe3JYlp9F3EU54vbpseseFQGBvNX/pmtrAMQ13aXrT26Q==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DBBPR04MB7580
X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE,
        RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS,T_SCC_BODY_TEXT_LINE,
        URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-bluetooth.vger.kernel.org>
X-Mailing-List: linux-bluetooth@vger.kernel.org

Issue
- Audio output descriptor & location read functions, requires code correction
- During reading audio location descriptor value was checked instead of pointer.
DBG statement wrongly accessed value to print the log that caused crash.

Fix
- Corrected audio output descriptor read variable
- Corrected the audio location debug printing function
- Allocated the memory as char pointer to the audio descriptor variable and
copied the string to be displayed.
- Corrected the audio descriptor pointer checking condition
---
 src/shared/vcp.c | 41 ++++++++++++++++++++++-------------------
 1 file changed, 22 insertions(+), 19 deletions(-)

diff --git a/src/shared/vcp.c b/src/shared/vcp.c
index 314618664..0408531b2 100644
--- a/src/shared/vcp.c
+++ b/src/shared/vcp.c
@@ -973,7 +973,7 @@ static void vocs_voaodec_read(struct gatt_db_attribute *attrib,
 	struct bt_vocs *vocs = user_data;
 	struct iovec iov;
 
-	iov.iov_base = &vocs->vocs_ao_dec;
+	iov.iov_base = vocs->vocs_ao_dec;
 	iov.iov_len = strlen(vocs->vocs_ao_dec);
 
 	gatt_db_attribute_read_result(attrib, id, 0, iov.iov_base,
@@ -1385,11 +1385,12 @@ static void read_vocs_audio_location(struct bt_vcp *vcp, bool success,
 				     const uint8_t *value, uint16_t length,
 				     void *user_data)
 {
-	uint32_t *vocs_audio_loc;
-	struct iovec iov = {
-		.iov_base = (void *) value,
-		.iov_len = length,
-	};
+	uint32_t vocs_audio_loc;
+
+	if (!value) {
+		DBG(vcp, "Unable to get VOCS Audio Location");
+		return;
+	}
 
 	if (!success) {
 		DBG(vcp, "Unable to read VOCS Audio Location: error 0x%02x",
@@ -1397,13 +1398,9 @@ static void read_vocs_audio_location(struct bt_vcp *vcp, bool success,
 		return;
 	}
 
-	vocs_audio_loc = iov_pull_mem(&iov, sizeof(uint32_t));
-	if (!*vocs_audio_loc) {
-		DBG(vcp, "Unable to get VOCS Audio Location");
-		return;
-	}
+	memcpy(&vocs_audio_loc, value, length);
 
-	DBG(vcp, "VOCS Audio Loc:%x", *vocs_audio_loc);
+	DBG(vcp, "VOCS Audio Loc: %x", vocs_audio_loc);
 }
 
 
@@ -1413,10 +1410,11 @@ static void read_vocs_audio_descriptor(struct bt_vcp *vcp, bool success,
 				       void *user_data)
 {
 	char *vocs_ao_dec_r;
-	struct iovec iov = {
-		.iov_base = (void *) value,
-		.iov_len = length,
-	};
+
+	if (!value) {
+		DBG(vcp, "Unable to get VOCS Audio Location");
+		return;
+	}
 
 	if (!success) {
 		DBG(vcp, "Unable to read VOCS Audio Descriptor: error 0x%02x",
@@ -1424,13 +1422,18 @@ static void read_vocs_audio_descriptor(struct bt_vcp *vcp, bool success,
 		return;
 	}
 
-	vocs_ao_dec_r = iov_pull_mem(&iov, length);
-	if (!*vocs_ao_dec_r) {
+	vocs_ao_dec_r = malloc(length+1);
+	memset(vocs_ao_dec_r, 0, length+1);
+	memcpy(vocs_ao_dec_r, value, length);
+
+	if (!vocs_ao_dec_r) {
 		DBG(vcp, "Unable to get VOCS Audio Descriptor");
 		return;
 	}
 
-	DBG(vcp, "VOCS Audio Descriptor:%s", *vocs_ao_dec_r);
+	DBG(vcp, "VOCS Audio Descriptor: %s", vocs_ao_dec_r);
+	free(vocs_ao_dec_r);
+	vocs_ao_dec_r = NULL;
 }
 
 static void vcp_pending_destroy(void *data)
-- 
2.34.1