2014-08-20 07:02:03

by Andrei Emeltchenko

[permalink] [raw]
Subject: [PATCH] android/health: Fix NULL dereference

From: Andrei Emeltchenko <[email protected]>

In a case get_app(), get_device(), get_channel() fail prevent
dereference of NULL pointer. Fixes clang warnings:
...
android/health.c:1980:15: warning: Access to field 'dev' results in a
dereference of a null pointer (loaded from variable 'channel')
queue_remove(channel->dev->channels, channel);
^~~~~~~~~~~~
1 warning generated.
...
---
android/health.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/android/health.c b/android/health.c
index c8af90e..665482e 100644
--- a/android/health.c
+++ b/android/health.c
@@ -1931,15 +1931,15 @@ static void bt_health_connect_channel(const void *buf, uint16_t len)

app = get_app(cmd->app_id);
if (!app)
- goto fail;
+ goto send_rsp;

dev = get_device(app, cmd->bdaddr);
if (!dev)
- goto fail;
+ goto send_rsp;

channel = get_channel(app, cmd->mdep_index, dev);
if (!channel)
- goto fail;
+ goto send_rsp;

if (!queue_length(dev->channels)) {
if (channel->type != CHANNEL_TYPE_RELIABLE) {
@@ -1979,6 +1979,8 @@ static void bt_health_connect_channel(const void *buf, uint16_t len)
fail:
queue_remove(channel->dev->channels, channel);
free_health_channel(channel);
+
+send_rsp:
ipc_send_rsp(hal_ipc, HAL_SERVICE_ID_HEALTH,
HAL_OP_HEALTH_CONNECT_CHANNEL, HAL_STATUS_FAILED);
}
--
1.9.1