diff mbox series

[BlueZ,v1,1/3] shared/vcp: prevent dereferencing of NULL pointers

Message ID 20240703123745.56443-2-r.smirnov@omp.ru (mailing list archive)
State Superseded
Headers show
Series fix errors found by SVACE static analyzer | expand

Checks

Context Check Description
tedd_an/pre-ci_am success Success
tedd_an/CheckPatch success CheckPatch PASS
tedd_an/GitLint success Gitlint PASS
tedd_an/BuildEll success Build ELL PASS
tedd_an/BluezMake success Bluez Make PASS
tedd_an/MakeCheck success Bluez Make Check PASS
tedd_an/MakeDistcheck success Make Distcheck PASS
tedd_an/CheckValgrind success Check Valgrind PASS
tedd_an/CheckSmatch success CheckSparse PASS
tedd_an/bluezmakeextell success Make External ELL PASS
tedd_an/IncrementalBuild success Incremental Build PASS
tedd_an/ScanBuild warning ScanBuild: src/shared/gatt-client.c:451:21: warning: Use of memory after it is freed gatt_db_unregister(op->client->db, op->db_id); ^~~~~~~~~~ src/shared/gatt-client.c:696:2: warning: Use of memory after it is freed discovery_op_complete(op, false, att_ecode); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ src/shared/gatt-client.c:996:2: warning: Use of memory after it is freed discovery_op_complete(op, success, att_ecode); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ src/shared/gatt-client.c:1102:2: warning: Use of memory after it is freed discovery_op_complete(op, success, att_ecode); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ src/shared/gatt-client.c:1296:2: warning: Use of memory after it is freed discovery_op_complete(op, success, att_ecode); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ src/shared/gatt-client.c:1361:2: warning: Use of memory after it is freed discovery_op_complete(op, success, att_ecode); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ src/shared/gatt-client.c:1636:6: warning: Use of memory after it is freed if (read_db_hash(op)) { ^~~~~~~~~~~~~~~~ src/shared/gatt-client.c:1641:2: warning: Use of memory after it is freed discover_all(op); ^~~~~~~~~~~~~~~~ src/shared/gatt-client.c:2145:6: warning: Use of memory after it is freed if (read_db_hash(op)) { ^~~~~~~~~~~~~~~~ src/shared/gatt-client.c:2153:8: warning: Use of memory after it is freed discovery_op_ref(op), ^~~~~~~~~~~~~~~~~~~~ src/shared/gatt-client.c:3242:2: warning: Use of memory after it is freed complete_write_long_op(req, success, 0, false); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ src/shared/gatt-client.c:3264:2: warning: Use of memory after it is freed request_unref(req); ^~~~~~~~~~~~~~~~~~ 12 warnings generated.

Commit Message

Roman Smirnov July 3, 2024, 12:37 p.m. UTC 
It is necessary to check that malloc() was able to allocate memory.

Found with the SVACE static analysis tool.
---
 src/shared/vcp.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

Comments

Luiz Augusto von Dentz July 3, 2024, 3:06 p.m. UTC | #1 
Hi Roman,

On Wed, Jul 3, 2024 at 8:39 AM Roman Smirnov <r.smirnov@omp.ru> wrote:
>
> It is necessary to check that malloc() was able to allocate memory.
>
> Found with the SVACE static analysis tool.
> ---
>  src/shared/vcp.c | 10 ++++++----
>  1 file changed, 6 insertions(+), 4 deletions(-)
>
> diff --git a/src/shared/vcp.c b/src/shared/vcp.c
> index b7e17e448..2ffdb22a0 100644
> --- a/src/shared/vcp.c
> +++ b/src/shared/vcp.c
> @@ -2128,14 +2128,15 @@ static void read_vocs_audio_descriptor(struct bt_vcp *vcp, bool success,
>         }
>
>         vocs_ao_dec_r = malloc(length+1);
> -       memset(vocs_ao_dec_r, 0, length+1);
> -       memcpy(vocs_ao_dec_r, value, length);
>
>         if (!vocs_ao_dec_r) {
>                 DBG(vcp, "Unable to get VOCS Audio Descriptor");
>                 return;
>         }
>
> +       memset(vocs_ao_dec_r, 0, length+1);
> +       memcpy(vocs_ao_dec_r, value, length);
> +
>         DBG(vcp, "VOCS Audio Descriptor: %s", vocs_ao_dec_r);
>         free(vocs_ao_dec_r);
>         vocs_ao_dec_r = NULL;
> @@ -2532,14 +2533,15 @@ static void read_aics_audio_ip_description(struct bt_vcp *vcp, bool success,
>         }
>
>         ip_descrptn = malloc(length+1);
> -       memset(ip_descrptn, 0, length+1);
> -       memcpy(ip_descrptn, value, length);
>
>         if (!ip_descrptn) {
>                 DBG(vcp, "Unable to get Audio Input Description");
>                 return;
>         }
>
> +       memset(ip_descrptn, 0, length+1);
> +       memcpy(ip_descrptn, value, length);
> +
>         DBG(vcp, "Audio Input Description: %s", ip_descrptn);
>         free(ip_descrptn);
>         ip_descrptn = NULL;
> --
> 2.43.0

We might be better off using util_memdup here since it already
incorporates these checks and aborts if we cannot allocate memory.

>
>
bluez.test.bot@gmail.com July 3, 2024, 3:13 p.m. UTC | #2 
This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=868017

---Test result---

Test Summary:
CheckPatch                    PASS      1.14 seconds
GitLint                       FAIL      1.02 seconds
BuildEll                      PASS      24.29 seconds
BluezMake                     PASS      1691.79 seconds
MakeCheck                     PASS      12.83 seconds
MakeDistcheck                 PASS      178.29 seconds
CheckValgrind                 PASS      254.24 seconds
CheckSmatch                   PASS      355.19 seconds
bluezmakeextell               PASS      123.81 seconds
IncrementalBuild              PASS      4661.28 seconds
ScanBuild                     WARNING   1010.11 seconds

Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[BlueZ,v1,2/3] client/player: fix wrong argument order in cmd_register_endpoint()

WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
1: T1 Title exceeds max length (81>80): "[BlueZ,v1,2/3] client/player: fix wrong argument order in cmd_register_endpoint()"
##############################
Test: ScanBuild - WARNING
Desc: Run Scan Build
Output:
src/shared/gatt-client.c:451:21: warning: Use of memory after it is freed
        gatt_db_unregister(op->client->db, op->db_id);
                           ^~~~~~~~~~
src/shared/gatt-client.c:696:2: warning: Use of memory after it is freed
        discovery_op_complete(op, false, att_ecode);
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:996:2: warning: Use of memory after it is freed
        discovery_op_complete(op, success, att_ecode);
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1102:2: warning: Use of memory after it is freed
        discovery_op_complete(op, success, att_ecode);
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1296:2: warning: Use of memory after it is freed
        discovery_op_complete(op, success, att_ecode);
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1361:2: warning: Use of memory after it is freed
        discovery_op_complete(op, success, att_ecode);
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1636:6: warning: Use of memory after it is freed
        if (read_db_hash(op)) {
            ^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1641:2: warning: Use of memory after it is freed
        discover_all(op);
        ^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:2145:6: warning: Use of memory after it is freed
        if (read_db_hash(op)) {
            ^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:2153:8: warning: Use of memory after it is freed
                                                        discovery_op_ref(op),
                                                        ^~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:3242:2: warning: Use of memory after it is freed
        complete_write_long_op(req, success, 0, false);
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:3264:2: warning: Use of memory after it is freed
        request_unref(req);
        ^~~~~~~~~~~~~~~~~~
12 warnings generated.



---
Regards,
Linux Bluetooth
diff mbox series

Patch

diff --git a/src/shared/vcp.c b/src/shared/vcp.c
index b7e17e448..2ffdb22a0 100644
--- a/src/shared/vcp.c
+++ b/src/shared/vcp.c
@@ -2128,14 +2128,15 @@  static void read_vocs_audio_descriptor(struct bt_vcp *vcp, bool success,
 	}
 
 	vocs_ao_dec_r = malloc(length+1);
-	memset(vocs_ao_dec_r, 0, length+1);
-	memcpy(vocs_ao_dec_r, value, length);
 
 	if (!vocs_ao_dec_r) {
 		DBG(vcp, "Unable to get VOCS Audio Descriptor");
 		return;
 	}
 
+	memset(vocs_ao_dec_r, 0, length+1);
+	memcpy(vocs_ao_dec_r, value, length);
+
 	DBG(vcp, "VOCS Audio Descriptor: %s", vocs_ao_dec_r);
 	free(vocs_ao_dec_r);
 	vocs_ao_dec_r = NULL;
@@ -2532,14 +2533,15 @@  static void read_aics_audio_ip_description(struct bt_vcp *vcp, bool success,
 	}
 
 	ip_descrptn = malloc(length+1);
-	memset(ip_descrptn, 0, length+1);
-	memcpy(ip_descrptn, value, length);
 
 	if (!ip_descrptn) {
 		DBG(vcp, "Unable to get Audio Input Description");
 		return;
 	}
 
+	memset(ip_descrptn, 0, length+1);
+	memcpy(ip_descrptn, value, length);
+
 	DBG(vcp, "Audio Input Description: %s", ip_descrptn);
 	free(ip_descrptn);
 	ip_descrptn = NULL;