Hi, On Thu, Jun 5, 2014 at 2:40 PM, bharat panda <bharat22bhusan@xxxxxxxxx> wrote: > Hi Marcel, > >>> NULL pointer check is added after memory allocation >>> to prevent core dump due to NULL pointer access. >>> >>> Signed-off-by: Bharat Panda <bharat.panda@xxxxxxxxxxx> >>> --- >>> profiles/audio/a2dp.c | 8 ++++++++ >>> profiles/audio/avctp.c | 4 ++++ >>> profiles/audio/avdtp.c | 16 ++++++++++++++++ >>> profiles/health/hdp.c | 4 +++- >>> profiles/health/mcap.c | 2 ++ >>> 5 files changed, 33 insertions(+), 1 deletion(-) >>> >>> diff --git a/profiles/audio/a2dp.c b/profiles/audio/a2dp.c >>> index c9dac9a..580cb60 100644 >>> --- a/profiles/audio/a2dp.c >>> +++ b/profiles/audio/a2dp.c >>> @@ -523,6 +523,8 @@ static gboolean endpoint_getcap_ind(struct avdtp *session, >>> a2dp_sep->user_data); >>> >>> codec_caps = g_malloc0(sizeof(*codec_caps) + length); >>> + if(!codec_caps) >>> + return -ENOMEM; >> >> the only way this can return NULL is when the size argument is 0. In all other cases it will abort the program. >> > In one of our a2dp connection test, we found it restarted bluetoothd, > and failed to store the capabilities because of NULL pointer abort. > Just to avoid same issue in other cases, I have added this check to > ignore the abort. If it is reproducible I would like to see the backlog of the crash, the length comes for dbus_message_iter_get_fixed_array which perhaps is failing and returning a bogus value which we are not checking. -- Luiz Augusto von Dentz -- To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
