diff options
| author | Matias Karhumaa <matias.karhumaa@gmail.com> | 2017-06-22 13:50:23 +0300 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2017-06-22 14:21:17 +0300 |
| commit | 3467bb836d1ede20f993c0a449d0be7e251f7e48 (patch) | |
| tree | 9d74b95b13f231a228d1ade1879d18aa2b4d45b2 /obexd | |
| parent | de4786090f85ee2cfbfdc8882fd5712b96ee5127 (diff) | |
| download | bluez-3467bb836d1ede20f993c0a449d0be7e251f7e48.tar.gz | |
obexd: Fix null pointer dereference.
By sending OPP Put request before CONNECT we were able to cause
SIGSEGV in obexd. Crash was caused by null pointer dereference.
Crash was found using Synopsys Defensics Obex Server test suite.
This was fixed by calling os->service->connect if CONNECT was not
done before.
Diffstat (limited to 'obexd')
| -rw-r--r-- | obexd/src/obex.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/obexd/src/obex.c b/obexd/src/obex.c index 788bffc6c..be79a778e 100644 --- a/obexd/src/obex.c +++ b/obexd/src/obex.c @@ -864,6 +864,17 @@ static void cmd_put(GObex *obex, GObexPacket *req, gpointer user_data) return; } + /* OPP session don't require CONNECT, in which case just call connect + * callback to register the transfer. + */ + if (!os->service_data && os->service->service == OBEX_OPP) { + os->service_data = os->service->connect(os, &err); + if (err < 0) { + os_set_response(os, err); + return; + } + } + parse_type(os, req); if (os->driver == NULL) { |