From 3467bb836d1ede20f993c0a449d0be7e251f7e48 Mon Sep 17 00:00:00 2001 From: Matias Karhumaa Date: Thu, 22 Jun 2017 13:50:23 +0300 Subject: obexd: Fix null pointer dereference. By sending OPP Put request before CONNECT we were able to cause SIGSEGV in obexd. Crash was caused by null pointer dereference. Crash was found using Synopsys Defensics Obex Server test suite. This was fixed by calling os->service->connect if CONNECT was not done before. --- obexd/src/obex.c | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'obexd') diff --git a/obexd/src/obex.c b/obexd/src/obex.c index 788bffc6c..be79a778e 100644 --- a/obexd/src/obex.c +++ b/obexd/src/obex.c @@ -864,6 +864,17 @@ static void cmd_put(GObex *obex, GObexPacket *req, gpointer user_data) return; } + /* OPP session don't require CONNECT, in which case just call connect + * callback to register the transfer. + */ + if (!os->service_data && os->service->service == OBEX_OPP) { + os->service_data = os->service->connect(os, &err); + if (err < 0) { + os_set_response(os, err); + return; + } + } + parse_type(os, req); if (os->driver == NULL) { -- cgit v1.2.1