2011-02-22 17:44:29

by Andre Guedes

Subject: [PATCH] Fix potential bug in le_advertising_report()

In the current implementation of le_advertising_report(), the variable
'info' has an invalid memory address after the 'for' loop. If 'info'
is dereferenced it will access invalid memory.

This patch fixes this potential bug and improves the code's readability.
---
plugins/hciops.c | 15 ++++++++++-----
1 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/plugins/hciops.c b/plugins/hciops.c
index c3d6290..fd19ef4 100644
--- a/plugins/hciops.c
+++ b/plugins/hciops.c
@@ -2184,14 +2184,19 @@ static inline void le_advertising_report(int index, evt_le_meta_event *meta)
{
struct dev_info *dev = &devs[index];
le_advertising_info *info;
- uint8_t num, i;
+ uint8_t num_reports;
+ const uint8_t RSSI_SIZE = 1;

- num = meta->data[0];
- info = (le_advertising_info *) (meta->data + 1);
+ num_reports = meta->data[0];

- for (i = 0; i < num; i++) {
+ info = (le_advertising_info *) &meta->data[1];
+ btd_event_advertising_report(&dev->bdaddr, info);
+ num_reports--;
+
+ while (num_reports--) {
+ info = (le_advertising_info *) (info->data + info->length +
+ RSSI_SIZE);
btd_event_advertising_report(&dev->bdaddr, info);
- info = (le_advertising_info *) (info->data + info->length + 1);
}
}

--
1.7.1

2011-02-23 03:00:52

by Johan Hedberg

Subject: Re: [PATCH] Fix potential bug in le_advertising_report()

Hi Andr?,

On Tue, Feb 22, 2011, Andre Guedes wrote:
> In the current implementation of le_advertising_report(), the variable
> 'info' has an invalid memory address after the 'for' loop. If 'info'
> is dereferenced it will access invalid memory.
>
> This patch fixes this potential bug and improves the code's readability.
> ---
> plugins/hciops.c | 15 ++++++++++-----
> 1 files changed, 10 insertions(+), 5 deletions(-)

The patch has been pushed upstream. Thanks.

Johan