2014-12-05 07:30:35

by Andrei Emeltchenko

Subject: [PATCH 1/2] shared/gatt: Fix NULL dereference

From: Andrei Emeltchenko <[email protected]>

The which is executed after checking (!op) is dereferencing op in
function discovery_op_free().
---
src/shared/gatt-client.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/shared/gatt-client.c b/src/shared/gatt-client.c
index 463de3b..96b5f1f 100644
--- a/src/shared/gatt-client.c
+++ b/src/shared/gatt-client.c
@@ -1101,11 +1101,12 @@ static void process_service_changed(struct bt_gatt_client *client,
return;
}

+ discovery_op_free(op);
+
fail:
util_debug(client->debug_callback, client->debug_data,
"Failed to initiate service discovery"
" after Service Changed");
- discovery_op_free(op);
}

static void service_changed_cb(uint16_t value_handle, const uint8_t *value,
--
1.9.1

2014-12-05 07:30:36

by Andrei Emeltchenko

Subject: [PATCH 2/2] tools/gatt: Fix not checking malloc() failure

From: Andrei Emeltchenko <[email protected]>

This follows standard practice elsewhere in this file.
---
tools/btgatt-client.c | 4 ++++
1 file changed, 4 insertions(+)

diff --git a/tools/btgatt-client.c b/tools/btgatt-client.c
index fe94ae8..01cfd93 100644
--- a/tools/btgatt-client.c
+++ b/tools/btgatt-client.c
@@ -458,6 +458,10 @@ static void cmd_read_multiple(struct client *cli, char *cmd_str)
}

value = malloc(sizeof(uint16_t) * argc);
+ if (!value) {
+ printf("Failed to construct value\n");
+ return;
+ }

for (i = 0; i < argc; i++) {
value[i] = strtol(argv[i], &endptr, 0);
--
1.9.1