2016-06-16 13:29:11

by Tobias Svehagen

Subject: [PATCH BlueZ] src/gatt-client: Fix iteration through options

Fix infinite loop when trying to read/write a characteristic or
a descriptor and the ReadValue/WriteValue call has at least one
option.
---
src/gatt-client.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/src/gatt-client.c b/src/gatt-client.c
index 0cbacca..6fc0d19 100644
--- a/src/gatt-client.c
+++ b/src/gatt-client.c
@@ -401,6 +401,8 @@ static int parse_options(DBusMessageIter *iter, uint16_t *offset)
return -EINVAL;
dbus_message_iter_get_basic(&value, offset);
}
+
+ dbus_message_iter_next(&dict);
}

return 0;
--
2.8.3

2016-06-17 08:45:31

by Luiz Augusto von Dentz

Subject: Re: [PATCH BlueZ 1/2] tools/gatt-service: Fix iteration through options

Hi Tobias,

On Thu, Jun 16, 2016 at 4:29 PM, Tobias Svehagen
<[email protected]> wrote:
> Fixes an infinite loop when trying to read a descriptor and the
> ReadValue call has at least one option.
> ---
> tools/gatt-service.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/tools/gatt-service.c b/tools/gatt-service.c
> index 0c78c4d..1cf8b3c 100644
> --- a/tools/gatt-service.c
> +++ b/tools/gatt-service.c
> @@ -407,6 +407,8 @@ static int parse_options(DBusMessageIter *iter, const char **device)
> dbus_message_iter_get_basic(&value, device);
> printf("Device: %s\n", *device);
> }
> +
> + dbus_message_iter_next(&dict);
> }
>
> return 0;
> --
> 2.8.3

Applied, thanks.

--
Luiz Augusto von Dentz

2016-06-17 08:44:54

by Luiz Augusto von Dentz

Subject: Re: [PATCH BlueZ] src/gatt-client: Fix iteration through options

Hi Tobias,

On Thu, Jun 16, 2016 at 4:29 PM, Tobias Svehagen
<[email protected]> wrote:
> Fix infinite loop when trying to read/write a characteristic or
> a descriptor and the ReadValue/WriteValue call has at least one
> option.
> ---
> src/gatt-client.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/src/gatt-client.c b/src/gatt-client.c
> index 0cbacca..6fc0d19 100644
> --- a/src/gatt-client.c
> +++ b/src/gatt-client.c
> @@ -401,6 +401,8 @@ static int parse_options(DBusMessageIter *iter, uint16_t *offset)
> return -EINVAL;
> dbus_message_iter_get_basic(&value, offset);
> }
> +
> + dbus_message_iter_next(&dict);
> }
>
> return 0;
> --
> 2.8.3

Applied, thanks.

--
Luiz Augusto von Dentz

2016-06-16 13:29:12

by Tobias Svehagen

Subject: [PATCH BlueZ 1/2] tools/gatt-service: Fix iteration through options

Fixes an infinite loop when trying to read a descriptor and the
ReadValue call has at least one option.
---
tools/gatt-service.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/tools/gatt-service.c b/tools/gatt-service.c
index 0c78c4d..1cf8b3c 100644
--- a/tools/gatt-service.c
+++ b/tools/gatt-service.c
@@ -407,6 +407,8 @@ static int parse_options(DBusMessageIter *iter, const char **device)
dbus_message_iter_get_basic(&value, device);
printf("Device: %s\n", *device);
}
+
+ dbus_message_iter_next(&dict);
}

return 0;
--
2.8.3

2016-06-16 13:29:13

by Tobias Svehagen

Subject: [PATCH BlueZ 2/2] tools/gatt-service: Do not call parse_options on reply message

A call to dbus_message_iter_get_arg_type will cause an assertion
since it is called on the wrong type of iterator.
---
tools/gatt-service.c | 4 ----
1 file changed, 4 deletions(-)

diff --git a/tools/gatt-service.c b/tools/gatt-service.c
index 1cf8b3c..6bd5576 100644
--- a/tools/gatt-service.c
+++ b/tools/gatt-service.c
@@ -515,10 +515,6 @@ static DBusMessage *desc_read_value(DBusConnection *conn, DBusMessage *msg,

dbus_message_iter_init_append(reply, &iter);

- if (parse_options(&iter, &device))
- return g_dbus_create_error(msg, DBUS_ERROR_INVALID_ARGS,
- "Invalid arguments");
-
desc_read(desc, &iter);

return reply;
--
2.8.3