From patchwork Mon Sep 28 06:44:46 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Aravind Machiry X-Patchwork-Id: 11802987 X-Patchwork-Delegate: luiz.dentz@gmail.com Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id AAC5F618 for ; Mon, 28 Sep 2020 06:45:10 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 877B2206BE for ; Mon, 28 Sep 2020 06:45:10 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=cs.ucsb.edu header.i=@cs.ucsb.edu header.b="XqqI2QSU" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726485AbgI1GpK (ORCPT ); Mon, 28 Sep 2020 02:45:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52792 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725290AbgI1GpK (ORCPT ); Mon, 28 Sep 2020 02:45:10 -0400 Received: from mail-pg1-x544.google.com (mail-pg1-x544.google.com [IPv6:2607:f8b0:4864:20::544]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E8EA1C0613CE for ; Sun, 27 Sep 2020 23:45:09 -0700 (PDT) Received: by mail-pg1-x544.google.com with SMTP id y14so7421997pgf.12 for ; Sun, 27 Sep 2020 23:45:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cs.ucsb.edu; s=google; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=fZJpLD4uYHRKMNGuo9mwwZSUN3GIyS/qi5PxKB8N12U=; b=XqqI2QSUxCNWyixMAgHn18AHsBFEGOX9zlH5aEqNVEdovK3AIGUd4E+fzecEpyv+Xr B/K9VzbPjSK0yLvHW3gOBtYMr18VFilfAZKnPF4TRwtKHHi0cFrvkqmiBnlKCQtlqYGi POtDJwVvTy5zLZZLzhBBzG+8x3MF5uBUFz5zYm68UVyxfjW6ejUipkveaQwJeEqsvdFI QwiDXLb7Um98DFAwHlFP2q4G1F25IoiJJOiID1bMJhbV6V0NowQcnSttY+ReX/iXThAj 07Jio6K09R2jikPWCuafPf/FOzrKTlm80IV+/0aC2m9fV9Add+88s2EtK78flgo1bOlN KqbA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=fZJpLD4uYHRKMNGuo9mwwZSUN3GIyS/qi5PxKB8N12U=; b=IeSud52h6BKzwS4U8L1z3Gx0CWYhues0dlSA/LtTZnGXhvj/0H1+xXU8OesLMJqYnj AwDWNIZwxuJ6mWyesQOC08GqGBQlQ1NzuAKTskMddLbgB1Lc1PSJwJ9Ssb1ayqDEe+Dt U5hINlEFO5zndW9YGFkV6FdJtOMxnZB0qrgJx/2wKHo3bwYaQ60ewX9RGns2aLIlcs8n LQIYCF+XpjG0jXn8s4KpeHWudHBD8GomaM4T4qHqQxZRr/s2xFKMY1OOwo0PL7tz89bb ++AjYBqmvKIGoV5QE4kT/hrTk6FpptJqbEfY4BkHPoHnGMw0Jcl5wU/iDkzxgM1iNEVc aixg== X-Gm-Message-State: AOAM531BLho/Z6C57Np1iHnBKq+DB3qT5le7dg493Afjehj23fcHFE2Z idkxjn+SsfOsSGXT5oOeJa99yls4wbM31wCohOcwD1g0GnqVnPi2EgZw9r2xjfpUdFeKlSmobna RTm1mj5yrvKLY29k1ArnuYDVNjxx91rPCUCNQPm/YCqgxlsZIaWJkMTZcTwkajTM22Q/nnMLDVQ rPDcGIYg== X-Google-Smtp-Source: ABdhPJw9dQSkKuqwuHnHIPYHJpSv4RqiQuy8dn6kk53OkA2u7hpb7riRHywwcgcU3fmT5gE8J5yWaQ== X-Received: by 2002:aa7:9a90:0:b029:142:2501:39e7 with SMTP id w16-20020aa79a900000b0290142250139e7mr9063313pfi.54.1601275509107; Sun, 27 Sep 2020 23:45:09 -0700 (PDT) Received: from localhost.localdomain (ip72-194-13-5.sb.sd.cox.net. [72.194.13.5]) by smtp.gmail.com with ESMTPSA id n9sm129705pgi.2.2020.09.27.23.45.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 27 Sep 2020 23:45:08 -0700 (PDT) From: Aravind Machiry To: linux-bluetooth@vger.kernel.org Cc: mhnaik@seas.upenn.edu, liby99@seas.upenn.edu, Aravind Machiry Subject: [PATCH BlueZ] lib/sdp.c: Validate attribute search return value Date: Sun, 27 Sep 2020 23:44:46 -0700 Message-Id: <20200928064446.17803-1-machiry@cs.ucsb.edu> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-bluetooth@vger.kernel.org The calls to gen_[searchseq|attridseq]_seq functions return negative value on failure. The return value should be checked to gracefully exit with a proper exit code. --- lib/sdp.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/lib/sdp.c b/lib/sdp.c index 532039a23..a27cd3a7b 100644 --- a/lib/sdp.c +++ b/lib/sdp.c @@ -3419,6 +3419,12 @@ int sdp_service_search_req(sdp_session_t *session, const sdp_list_t *search, /* add service class IDs for search */ seqlen = gen_searchseq_pdu(pdata, search); + if (seqlen < 0) { + errno = EINVAL; + status = -1; + goto end; + } + SDPDBG("Data seq added : %d", seqlen); /* set the length and increment the pointer */ @@ -3841,6 +3847,11 @@ int sdp_service_search_async(sdp_session_t *session, const sdp_list_t *search, u /* add service class IDs for search */ seqlen = gen_searchseq_pdu(pdata, search); + if (seqlen < 0) { + t->err = EINVAL; + goto end; + } + SDPDBG("Data seq added : %d", seqlen); /* now set the length and increment the pointer */ @@ -4054,6 +4065,11 @@ int sdp_service_search_attr_async(sdp_session_t *session, const sdp_list_t *sear /* add service class IDs for search */ seqlen = gen_searchseq_pdu(pdata, search); + if (seqlen < 0) { + t->err = EINVAL; + goto end; + } + SDPDBG("Data seq added : %d", seqlen); /* now set the length and increment the pointer */