summaryrefslogtreecommitdiff
path: root/lib/sdp.c
Commit message (Collapse)AuthorAgeFilesLines
* lib: Fix the unchecked return valueTedd Ho-Jeong An2020-11-241-1/+2
| | | | This patch fixes the unchecked return value.
* lib: Replace malloc/memset(..0..) with bt_malloc0Aravind Machiry2020-10-071-24/+12
| | | | | This patch replaces various instances of malloc and subsequent memset(..,0,..) with bt_malloc0 (i.e., calloc) for efficiency.
* lib/sdp.c: Validate attribute search return valueAravind Machiry2020-10-071-0/+16
| | | | | | The calls to gen_[searchseq|attridseq]_seq functions return negative value on failure. The return value should be checked to gracefully exit with a proper exit code.
* lib: Add SPDX License IdentifierTedd Ho-Jeong An2020-09-211-14/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds SPDX License Identifier and removes the license text. ------------------------------------- License COUNT ------------------------------------- GPL-2.0-or-later : 18 GPL-2.0-only : 1 License: GPL-2.0-or-later lib/sco.h lib/sdp.c lib/a2mp.h lib/uuid.h lib/bluetooth.h lib/hidp.h lib/rfcomm.h lib/hci.c lib/sdp.h lib/sdp_lib.h lib/bluetooth.c lib/mgmt.h lib/hci.h lib/uuid.c lib/l2cap.h lib/bnep.h lib/hci_lib.h lib/cmtp.h License: GPL-2.0-only lib/amp.h
* sdp: Fix buffer overflowLuiz Augusto von Dentz2018-11-021-0/+6
| | | | | | | | | sdp_append_buf shall check if there is enough space to store the data before copying it. An independent security researcher, Julian Rauchberger, has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.
* lib: Fix missing error handling when SDP record is NULLMarcel Holtmann2015-11-101-2/+6
|
* lib/sdp: Fix resource leak in sdp_get_supp_featLuiz Augusto von Dentz2015-08-131-0/+1
| | | | | | In case dtd is unknow it would jump to fail without freeing what has been allocated in subseq which is not appended to tseq so it could not be freed.
* lib/sdp: Split error handing for length and transaction idLuiz Augusto von Dentz2014-09-051-3/+8
| | | | | This split the handling of invalid PDU length and not matching transaction id adding proper debug logs.
* lib/sdp: Fix typoJakub Tyszkowski2014-09-041-4/+4
|
* lib/sdp: Fix printing of multiple record fieldsAnderson Lizardo2014-02-211-3/+3
| | | | | If there are multiple fields to print, sdp_record_print() was missing a newline between entries.
* lib/sdp: Add missing Service Class ID for GAPAnderson Lizardo2014-02-211-1/+2
| | | | Also reorder last ID so the list remains ordered.
* lib: Add flag to force large MTU size used for SDP connectionSzymon Janc2014-01-201-0/+27
| | | | | | This will allow to workaround Dualshock4 not respecting L2CAP MTU size while sending SDP response. Use same L2CAP MTU value base on RFCOMM.
* lib/sdp: Fix incorrect sizeof argumentAndrei Emeltchenko2014-01-091-1/+1
| | | | length is a pointer to int table not int* table.
* lib/sdp: Replace VIDEO_CONF_SVCLASS_ID with AV_REMOTE_CONTROLLER_SVCLASS_IDLuiz Augusto von Dentz2013-10-091-1/+1
| | | | | | | VCP apparently was never adopted so 0x110f was latter reused by AVRCP 1.3 controller as per current assigned numbers page: https://www.bluetooth.org/en-us/specification/assigned-numbers/service-discovery
* lib: Fix use of uninitialized variable in sdp_set_profile_descsSzymon Janc2013-09-301-7/+8
| | | | | | | | | | | | | | | Error path on default case was not breaking loop. To keep error handling similar all error path were converted to use goto. This fix following: target C: libbluetooth <= external/bluetooth/bluez/android/../lib/sdp.c lib/sdp.c: In function 'sdp_set_profile_descs': lib/sdp.c:487:10: warning: 'values[0]' may be used uninitialized in this function [-Wmaybe-uninitialized] lib/sdp.c:2562:19: note: 'values[0]' was declared here lib/sdp.c:545:11: warning: 'dtds[0]' may be used uninitialized in this function [-Wmaybe-uninitialized] lib/sdp.c:2562:9: note: 'dtds[0]' was declared here
* lib: Add range check for SDP_SVC_ATTR_RSP/SDP_SVC_SEARCH_ATTR_RSPSzymon Janc2013-07-101-0/+8
| | | | | | | | | | This is an improved version of recently reverted commit 1796f00e8465. Response size is verified against minimal allowed value only if it is complete response. If response is partial it is allowed by spec that it will be split in arbitrary manner. Verified against Nokia BH217 on which original commit caused regression.
* Revert "lib: Add range check for SDP_SVC_ATTR_RSP/SDP_SVC_SEARCH_ATTR_RSP"Johan Hedberg2013-06-251-8/+0
| | | | | | | This reverts commit 1796f00e846561af80679efba4d7c36c78710fb6. This patch causes a regression with the Nokia BH217 headset. A correct patch must take into account fragmented responses.
* lib: Cleanup SDP logs to not include double new linesSzymon Janc2013-06-241-93/+90
| | | | SDPERR and SDPDBG already add new line to prints.
* lib: Fix sdp_seq_alloc_with_length accessing invalid index/memoryLuiz Augusto von Dentz2013-05-231-1/+1
| | | | | | | | | The sequence itself is not an index of dtds, values, lengths, thats why SDP_SEQ8 is used directly as dtd, so accessing length[i] is always off by one. Furthermore the length is not really used by sdp_data_alloc_with_length when the dtd is SDP_SEQ8 which is probably why it doesn't crash.
* lib: Fix invalid memory access in sdp_service_search_attr_reqArkadiusz Lichwa2013-04-041-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Browsing services using sdptool can lead to writing to invalid heap locations. valgrind's output of exemplary call: sdptool browse local ==2203== HEAP SUMMARY: ==2203== in use at exit: 0 bytes in 0 blocks ==2203== total heap usage: 251 allocs, 251 frees, 140,156 bytes allocated ==2203== ==2203== All heap blocks were freed -- no leaks are possible ==2203== ==2203== ERROR SUMMARY: 6 errors from 2 contexts (suppressed: 0 from 0) ==2203== ==2203== 1 errors in context 1 of 2: ==2203== Invalid write of size 2 ==2203== at 0x805B882: bt_put_be16 (in /home/xpu/gits/bluez.bin/bin/sdptool) ==2203== by 0x8062BD0: sdp_service_search_attr_req (in /home/xpu/gits/bluez.bin/bin/sdptool) ==2203== by 0x8052457: do_search (in /home/xpu/gits/bluez.bin/bin/sdptool) ==2203== by 0x80525AE: do_search (in /home/xpu/gits/bluez.bin/bin/sdptool) ==2203== by 0x805277F: cmd_browse (in /home/xpu/gits/bluez.bin/bin/sdptool) ==2203== by 0x8053199: main (in /home/xpu/gits/bluez.bin/bin/sdptool) ==2203== Address 0x4391359 is 7 bytes before a block of size 2,048 alloc'd ==2203== at 0x402B6A8: malloc (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so) ==2203== by 0x8062B4B: sdp_service_search_attr_req (in /home/xpu/gits/bluez.bin/bin/sdptool) ==2203== by 0x8052457: do_search (in /home/xpu/gits/bluez.bin/bin/sdptool) ==2203== by 0x80525AE: do_search (in /home/xpu/gits/bluez.bin/bin/sdptool) ==2203== by 0x805277F: cmd_browse (in /home/xpu/gits/bluez.bin/bin/sdptool) ==2203== by 0x8053199: main (in /home/xpu/gits/bluez.bin/bin/sdptool) ==2203== ==2203== ==2203== 5 errors in context 2 of 2: ==2203== Invalid write of size 1 ==2203== at 0x402D363: memcpy (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so) ==2203== by 0x80613E7: gen_dataseq_pdu (in /home/xpu/gits/bluez.bin/bin/sdptool) ==2203== by 0x8061472: gen_attridseq_pdu (in /home/xpu/gits/bluez.bin/bin/sdptool) ==2203== by 0x8062C00: sdp_service_search_attr_req (in /home/xpu/gits/bluez.bin/bin/sdptool) ==2203== by 0x8052457: do_search (in /home/xpu/gits/bluez.bin/bin/sdptool) ==2203== by 0x80525AE: do_search (in /home/xpu/gits/bluez.bin/bin/sdptool) ==2203== by 0x805277F: cmd_browse (in /home/xpu/gits/bluez.bin/bin/sdptool) ==2203== by 0x8053199: main (in /home/xpu/gits/bluez.bin/bin/sdptool) ==2203== Address 0x439135b is 5 bytes before a block of size 2,048 alloc'd ==2203== at 0x402B6A8: malloc (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so) ==2203== by 0x8062B4B: sdp_service_search_attr_req (in /home/xpu/gits/bluez.bin/bin/sdptool) ==2203== by 0x8052457: do_search (in /home/xpu/gits/bluez.bin/bin/sdptool) ==2203== by 0x80525AE: do_search (in /home/xpu/gits/bluez.bin/bin/sdptool) ==2203== by 0x805277F: cmd_browse (in /home/xpu/gits/bluez.bin/bin/sdptool) ==2203== by 0x8053199: main (in /home/xpu/gits/bluez.bin/bin/sdptool) ==2203== ==2203== ERROR SUMMARY: 6 errors from 2 contexts (suppressed: 0 from 0)
* lib: Validate DTDs when parsing VersionNumberListAnderson Lizardo2013-02-181-1/+16
|
* lib: Add comment to BluetoothProfileDescriptorList parsing workaroundAnderson Lizardo2013-02-181-0/+5
| | | | | Commits 0f5a5a9580084a3c4e0644ef5cd75689aeb5ff40 and 46b3a3d2d00bf70bc57ef0c9ad5542a2271e3350 introduced this workaround.
* lib: Validate DTDs when parsing BluetoothProfileDescriptorListAnderson Lizardo2013-02-181-9/+28
| | | | | | The "seq->val.dataseq != NULL" check is also removed from the for() statement because it should be done after verifying that the data element is a sequence (inside the "if (SDP_IS_SEQ(...))" block.)
* lib: Validate DTDs when parsing LanguageBaseAttributeIDListAnderson Lizardo2013-02-181-7/+25
| | | | Also check if the required number of entries is present.
* lib: Add missing DTD validation in sdp_record_print()Anderson Lizardo2013-02-181-3/+3
|
* lib: Fix missing DTD validation while accessing SDP data elementsAnderson Lizardo2013-02-181-2/+24
| | | | | | | It is necessary to validate the sdp_data_t "dtd" field before accessing the "val" union members, specially when handling SDP_SEQ*, SDP_ALT* and SDP_STR* elements, otherwise remote devices can trigger memory corruption by passing invalid data elements where others are expected.
* lib: Cleanup coding style in sdp_get_proto_descs()Anderson Lizardo2013-02-181-3/+6
|
* lib: Reuse identical code in sdp_get_{add,}_access_protos()Anderson Lizardo2013-02-181-22/+12
| | | | | | sdp_get_access_protos() and sdp_get_add_access_protos() do almost exactly the same thing, except for an additional statement for the latter.
* lib: Check if SDP buffer has enough data on partial responsesAnderson Lizardo2013-02-151-1/+6
| | | | | Before manipulating data from previous partial responses, make sure the buffer has enough data.
* lib: Add range check for SDP_SVC_ATTR_RSP/SDP_SVC_SEARCH_ATTR_RSPAnderson Lizardo2013-02-151-0/+8
| | | | | According to SDP spec, the byte count fields for these PDUs have a valid range of 0x0002-0xFFFF.
* lib: Fix buffer overflow when processing SDP responseAnderson Lizardo2013-02-151-0/+11
| | | | | | | | rsp_count is either read or calculated from untrusted input, and therefore needs to be checked before being used as offset. The "plen" variable is appropriate because it is calculated as the sum of fixed and variable length fields, excluding the continuation state field, which has at least 1 byte for its own length field.
* lib: Fix SDP_TEXT_STR16/SDP_URL_STR16 parsingAnderson Lizardo2013-01-081-1/+1
| | | | | | | | | | | | | sdp_extract_attr() uses the "size" parameter to return the number of bytes consumed when parsing SDP Data Elements. This size is used to advance a buffer pointer to parse next element. This size was being incorrectly calculated for SDP_{TEXT,URL}_STR16 in extract_str(), where the string length was added twice. The string length is already added later in the function for {TEXT,URL}_STR{8,16} by this statement: *len += n;
* lib: Use SDP_IS_TEXT_STR()/SDP_IS_SEQ() where possibleAnderson Lizardo2013-01-071-7/+5
|
* lib: Use SOCK_CLOEXEC where neededCristian Rodríguez2012-12-241-7/+6
| | | | | Calling programs might fork().. execve() and we will end up leaking fds.
* lib: use %m instead of strerrorCristian Rodríguez2012-12-241-9/+8
| | | | | Unlike strerror, %m is thread safe and we do not know to what kind of program libbluetooth is being linked too.
* sdp: Fix build errors due to unaligned memory accessSzymon Janc2012-12-111-4/+18
| | | | | | | | | | | | | | | | | | | | | | | | | This fix following compilation errors on ARM. CC lib/sdp.lo lib/sdp.c: In function 'sdp_device_record_unregister_binary': lib/sdp.c:2984:11: error: cast increases required alignment of target type [-Werror=cast-align] lib/sdp.c:2984:11: error: cast increases required alignment of target type [-Werror=cast-align] lib/sdp.c: In function 'sdp_device_record_update': lib/sdp.c:3089:11: error: cast increases required alignment of target type [-Werror=cast-align] lib/sdp.c:3089:11: error: cast increases required alignment of target type [-Werror=cast-align] lib/sdp.c: In function 'sdp_process': lib/sdp.c:4139:22: error: cast increases required alignment of target type [-Werror=cast-align] lib/sdp.c:4146:14: error: cast increases required alignment of target type [-Werror=cast-align] lib/sdp.c:4146:14: error: cast increases required alignment of target type [-Werror=cast-align] cc1: all warnings being treated as errors make[1]: *** [lib/sdp.lo] Error 1
* Revert "Ensure config.h is included by using CPPFLAGS"Johan Hedberg2012-12-071-0/+4
| | | | | | | | | | | | | | This reverts commit 8a03376544b046a84301847d1594f6c3674983ff. The patch needs to be split up and the gdbus/ changes were bogus compared to the original commit message. Conflicts: Makefile.am Makefile.obexd profiles/cyclingspeed/cyclingspeed.c profiles/heartrate/heartrate.c src/error.c
* Ensure config.h is included by using CPPFLAGSLucas De Marchi2012-12-051-4/+0
| | | | | | | | | | Instead of trying to include config.h in each file over the tree and possibly forgetting to include it, give a "-include config.h" argument to the compiler so it's guaranteed that a) it will be included for all source files and b) it will be the first header included. gdbus/ directory is left out, since it would break other projects using it.
* lib: Add missing svclass entries for MAPJohan Hedberg2012-11-231-0/+3
|
* sdp: Upgrade datatype SEQ8 to SEQ16 when data size is greater than 256Bart Westgeest2012-11-201-6/+12
| | | | | Fixes a bug where the complete sequence data is written, but the size is truncated to one byte.
* sdp: Limit side effects of sdp_get_data_type and sdp_get_data_sizeBart Westgeest2012-11-201-17/+9
| | | | | | | Remove modification of buf->buf_size in 'get' functions. Data is still indirectly modified due to recursive nature of code. Renamed sdp_get_data_type to sdp_get_data_type_size.
* sdp: Inlined single use of function sdp_set_data_typeBart Westgeest2012-11-201-13/+5
| | | | | Inlining single use of sdp_set_data_type to improve code readability, since the function was doing more than just setting the data type.
* sdp: Use bt_get_be* helpers instead of bt_get_unalignedSzymon Janc2012-09-051-18/+18
| | | | | | | | | | | | | | This fix number of compilation errors on ARM similar to one below. lib/sdp.c: In function 'sdp_uuid_extract': lib/sdp.c:1019:27: error: cast increases required alignment of target type [-Werror=cast-align] lib/sdp.c:1019:27: error: cast increases required alignment of target type [-Werror=cast-align] lib/sdp.c:1026:27: error: cast increases required alignment of target type [-Werror=cast-align] lib/sdp.c:1026:27: error: cast increases required alignment of target type [-Werror=cast-align]
* sdp: Fix compilation errors due to unaligned memory accessSzymon Janc2012-09-051-15/+15
| | | | | | | | | | | | | | This fix number of build errors on ARM similar to one below. lib/sdp.c: In function 'sdp_set_seq_len': lib/sdp.c:625:3: error: cast increases required alignment of target type [-Werror=cast-align] lib/sdp.c:625:3: error: cast increases required alignment of target type [-Werror=cast-align] lib/sdp.c:631:3: error: cast increases required alignment of target type [-Werror=cast-align] lib/sdp.c:631:3: error: cast increases required alignment of target type [-Werror=cast-align]
* sdp: Fix error reporting in sdp_service_search_attr_reqSzymon Janc2012-08-281-1/+2
| | | | This function reports error code via errno not return value.
* Fix trivial coding style issues on pointer declarations and castingAnderson Lizardo2012-08-261-2/+2
| | | | | Avoid using C++ style pointer declarations like "char* ptr", as most BlueZ code uses "char *ptr".
* lib/sdp.c: Prevent passing unitialised argumentSlawomir Bochenski2012-06-281-4/+8
| | | | | In case of sdp_seq_alloc() failures in loop, unitialised seqDTDs would be passed to final sdp_seq_alloc.
* sdp: Remove unused BASE_UUID definitionDaniel Wagner2012-06-021-2/+0
|
* sdp/build: Build fails when SDP_DEBUG enabledArek Lichwa2012-05-231-2/+1
| | | | Enabling SDP_DEBUG prevents build to be done.
* sdp: Remove unnecessary memset()Anderson Lizardo2012-05-181-1/+0
| | | | | The memory referenced by "u" pointer is initialized right after the memset() call.
View Lorry Controller Status