Received-SPF: pass (google.com: domain of linux-bluetooth+bounces-2612-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
From: Vlad Pruteanu <vlad.pruteanu@nxp.com>
To: linux-bluetooth@vger.kernel.org
Cc: mihai-octavian.urzica@nxp.com,
	silviu.barbulescu@nxp.com,
	iulia.tanasescu@nxp.com,
	andrei.istodorescu@nxp.com,
	luiz.dentz@gmail.com,
	Vlad Pruteanu <vlad.pruteanu@nxp.com>
Subject: [PATCH BlueZ 3/3] client/player: Use util_iov_append instead of iov_append
Date: Tue, 19 Mar 2024 17:19:17 +0200
Message-Id: <20240319151917.834974-4-vlad.pruteanu@nxp.com>
In-Reply-To: <20240319151917.834974-1-vlad.pruteanu@nxp.com>
References: <20240319151917.834974-1-vlad.pruteanu@nxp.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
	=?us-ascii?Q?yTd3zuyReIOxxJWOxlNJrniKRMqIQiv7elVV4G9sDSih5fWU2H4r8Y3e90Yo?=
 =?us-ascii?Q?x9UdmncwddxgxzuAvDp1oT6cOmyv9asmCGGadc+oP9yTW2i5F7y3RZI236WM?=
 =?us-ascii?Q?zjjOAs3BiHmfdc1acF/UMdp5CgzFuNXQYfjrvOYrFhaXz+/goBHV2u/0sf8L?=
 =?us-ascii?Q?sMws+MUjFkSVTGucWEwugyhiHVsvQA1aUiD8reVjgvWlO2tuip3uLpUWZhi3?=
 =?us-ascii?Q?C5b8CfOuXN/zBEURr88katXu00LYrdwJuVaKd/E4L3ZRi2Z22kRl2GdSBMS7?=
 =?us-ascii?Q?szH7PcyvwqTNM0GxJbNM65VOWOID49rKYk2C3GHN/3BgGXgLUzD81879gHlR?=
 =?us-ascii?Q?jzL2r7u90zkZ+2HA4sZWvICvZnsqNEt8VVzhe3vg8+6ku/usrHYrWH4XcK8D?=
 =?us-ascii?Q?bvofEUk1kXroHAkNxU+o8Y0mU2KzBIXLMabkTf9EX/vOJMRpZWMUU68FoLSp?=
 =?us-ascii?Q?d7ZdWeEDQiKJ6Xwi9jWQDJzGSKmFkptbiotWJiS+GF0ifLBcVEVaPvXQPR6r?=
 =?us-ascii?Q?M8zl0V4zShP3A2zkk0dJ6E4qYE5aLcInc1vyMRBSiIhM6cCg25SHlQQrns/F?=
 =?us-ascii?Q?LWmFCi9h/R/6VaI2xgofCUdTdJAwsffFHJj/mzlltboBZMiADqEo+MPRPrrl?=
 =?us-ascii?Q?w1teHihGUscJXFy6kZry4i+KbCW9qADo6xpvLaOEDuaHEx+RhL817So0cgES?=
 =?us-ascii?Q?xgjQK6tGtabtlRsc8cZfP8NXRHLPD65ufn+QpgdDqRC36f6ngu4lTFt/mefo?=
 =?us-ascii?Q?gRzlbmh89v9/6MvBkAVSp2Cg8LRDo73kphMh5EKteH7T8cbqcfyKirv5zcXh?=
 =?us-ascii?Q?kM79aeIudctmhHMG/76EM2tl3m5sYAhO4Q4Q3p1CGlXQJU4J2XQhujw8LWeY?=
 =?us-ascii?Q?YhRBABInhkow+2At9avgZMt3IAgMqzcm8L6OTLYSLeT9/6Gskz0q5+U43mQQ?=
 =?us-ascii?Q?EVEAVEADnQIbaEm9z2bSdJJgY9kz0QG01rcy5TRaC5TvXizGhFbUhna7Iybe?=
 =?us-ascii?Q?Cs7xzLzTxm377JhYpZvSc1FLlbj8z961QruFsbzGc8xcZqXfzS2bi7WEUHMq?=
 =?us-ascii?Q?jlXLzFvpjIGesMxbEliq39kxMDcjMUswgb+V87GWhidEbRdpX0H8lqAlYKwY?=
 =?us-ascii?Q?ytE2kubwHLYsp4Y0ztwC2NGWOu2sDdD1aHNbScexcWloTtx2ogBr3Zi8onn5?=
 =?us-ascii?Q?iMPHFhkPYT11I8OlDWXa9LWM0jt9MxkeKkWViiDLmHvrv+LJCet3a1ir/yxz?=
 =?us-ascii?Q?pLT09kLyGBVb0LbBK2P4rPyth3X6ZUX6sqQov6++S3kvWwj+eQiGtzSI5uFy?=
 =?us-ascii?Q?fyeu+KD7KwNvtqSyV3Igt7Wxc3xPydetasFUfiBNbSxdrt5xGFhc1F6VkvUt?=
 =?us-ascii?Q?rhTETgzx08Z6kWKlqqaZMPJbxkSiW3mTDbEtZ1WxezJh1zP9HpFP+yXLF6+B?=
 =?us-ascii?Q?u8GOARHHX4n5x7Gwo9FYiuFW28BWI1oNwf+jdPKYeKVSbGMS15UbBGDXy6tW?=
 =?us-ascii?Q?vvSTZOTG274DAMoXF94aHzsQ9b/j0iebYRBgSZXOpSyEtdQxh0zh2kJJhZb4?=
 =?us-ascii?Q?DF8jD/N6DD1HoccCIcDjnCtsz5qq03RcwuwSYSU5?=
X-OriginatorOrg: nxp.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 6916d720-479a-4875-b93d-08dc48280728
X-MS-Exchange-CrossTenant-AuthSource: AM6PR04MB5384.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Mar 2024 15:19:53.8836
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 842uRRZnit5eMCk76az4kQos5S5RKEGIpRZLw5tsECIfzCgPWVFT40OrVb8o53Yl69C0f9Ehx8AfN8eM1XweCQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS5PR04MB9924

util_iov_append has been recently created. This implementation
allocates new memory for the appended data, while the old
version of iov_append from client/player.c did not. This could
lead to crashes in some scenarios, such as Unicast.
---
 client/player.c | 35 ++++++++++-------------------------
 1 file changed, 10 insertions(+), 25 deletions(-)

diff --git a/client/player.c b/client/player.c
index 8081ddc13..ab33bfc46 100644
--- a/client/player.c
+++ b/client/player.c
@@ -1951,23 +1951,6 @@ static void append_properties(DBusMessageIter *iter,
 	dbus_message_iter_close_container(iter, &dict);
 }
 
-static struct iovec *iov_append(struct iovec **iov, const void *data,
-							size_t len)
-{
-	if (!*iov)
-		*iov = new0(struct iovec, 1);
-
-	if (!((*iov)->iov_base))
-		(*iov)->iov_base = new0(uint8_t, UINT8_MAX);
-
-	if (data && len) {
-		memcpy((*iov)->iov_base + (*iov)->iov_len, data, len);
-		(*iov)->iov_len += len;
-	}
-
-	return *iov;
-}
-
 static int parse_chan_alloc(DBusMessageIter *iter, uint32_t *location,
 						uint8_t *channels)
 {
@@ -2033,7 +2016,8 @@ static DBusMessage *endpoint_select_properties_reply(struct endpoint *ep,
 			location >> 8, location >> 16, location >> 24
 		};
 
-		iov_append(&cfg->caps, &chan_alloc_ltv, sizeof(chan_alloc_ltv));
+		util_iov_append(cfg->caps, &chan_alloc_ltv,
+						sizeof(chan_alloc_ltv));
 	}
 
 	/* Copy metadata */
@@ -3540,7 +3524,7 @@ static void endpoint_config(const char *input, void *user_data)
 
 	data = str2bytearray((char *) input, &len);
 
-	iov_append(&cfg->caps, data, len);
+	util_iov_append(cfg->caps, data, len);
 	free(data);
 
 	endpoint_set_config(cfg);
@@ -3662,7 +3646,7 @@ static void config_endpoint_iso_group(const char *input, void *user_data)
 static void endpoint_set_config_bcast(struct endpoint_config *cfg)
 {
 	cfg->ep->bcode = g_new0(struct iovec, 1);
-	iov_append(&cfg->ep->bcode, bcast_code,
+	util_iov_append(cfg->ep->bcode, bcast_code,
 			sizeof(bcast_code));
 
 	if ((strcmp(cfg->ep->uuid, BAA_SERVICE_UUID) == 0)) {
@@ -3707,8 +3691,9 @@ static void cmd_config_endpoint(int argc, char *argv[])
 			goto fail;
 		}
 
+		cfg->caps = g_new0(struct iovec, 1);
 		/* Copy capabilities */
-		iov_append(&cfg->caps, preset->data.iov_base,
+		util_iov_append(cfg->caps, preset->data.iov_base,
 				preset->data.iov_len);
 
 		/* Set QoS parameters */
@@ -3937,7 +3922,7 @@ static void custom_length(const char *input, void *user_data)
 	ltv[2] = len;
 	ltv[3] = len >> 8;
 
-	iov_append(&iov, ltv, sizeof(ltv));
+	util_iov_append(iov, ltv, sizeof(ltv));
 
 	bt_shell_prompt_input("QoS", "Enter Target Latency "
 				"(Low, Balance, High):",
@@ -3963,7 +3948,7 @@ static void custom_location(const char *input, void *user_data)
 
 		location = cpu_to_le32(location);
 		memcpy(&ltv[2], &location, sizeof(location));
-		iov_append(&iov, ltv, sizeof(ltv));
+		util_iov_append(iov, ltv, sizeof(ltv));
 	}
 
 	bt_shell_prompt_input("Codec", "Enter frame length:",
@@ -4006,7 +3991,7 @@ static void custom_duration(const char *input, void *user_data)
 		return bt_shell_noninteractive_quit(EXIT_FAILURE);
 	}
 
-	iov_append(&iov, ltv, sizeof(ltv));
+	util_iov_append(iov, ltv, sizeof(ltv));
 
 	bt_shell_prompt_input("Codec", "Enter channel allocation:",
 					custom_location, user_data);
@@ -4074,7 +4059,7 @@ static void custom_frequency(const char *input, void *user_data)
 	free(iov->iov_base);
 	iov->iov_base = NULL;
 	iov->iov_len = 0;
-	iov_append(&iov, ltv, sizeof(ltv));
+	util_iov_append(iov, ltv, sizeof(ltv));
 
 	bt_shell_prompt_input("Codec", "Enter frame duration (ms):",
 				custom_duration, user_data);
-- 
2.39.2