There is no check that SelectConfiguration call on MediaEndpoint1
returns an array before accessing the array. When the return from
SelectConfiguration is not an array type bluetoothd crashes.
Ignore the reply in that case.
---
profiles/audio/media.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/profiles/audio/media.c b/profiles/audio/media.c
index 69070bf..a5cb490 100644
--- a/profiles/audio/media.c
+++ b/profiles/audio/media.c
@@ -292,6 +292,12 @@ static void endpoint_reply(DBusPendingCall *call, void *user_data)
dbus_message_iter_init(reply, &args);
+ if (dbus_message_iter_get_arg_type(&args) != DBUS_TYPE_ARRAY) {
+ error("SelectConfiguration did not return an array: %s",
+ dbus_message_get_signature(reply));
+ goto done;
+ }
+
dbus_message_iter_recurse(&args, &array);
dbus_message_iter_get_fixed_array(&array, &configuration, &size);
--
2.6.2
--
To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
