Parent: 756d69fd3db8c84b88073c1467ba6b282ab5dbdd
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Committer: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: 2024-12-09 04:18:28
Tree: 28829b8e522fccc9e915d627ee283b145855b781
shared/gatt-db: Fix possible crash on gatt_db_clone The following crash can happen if the original gatt_db has incomplete service definitions since the attribute might still be discovering: Invalid read of size 4 at 0x1E5A39: bt_uuid_len (uuid.h:289) by 0x1E5A39: service_clone (gatt-db.c:284) by 0x1D5EBB: queue_foreach (queue.c:207) by 0x1E61CD: gatt_db_clone (gatt-db.c:329) by 0x1C18F0: btd_device_set_gatt_db (device.c:7110) by 0x1C9F96: foreach_rsi (set.c:295) by 0x1D5EBB: queue_foreach (queue.c:207) by 0x48EA91F: g_slist_foreach (in /usr/lib64/libglib-2.0.so.0.8000.3) by 0x1CA2C8: btd_set_add_device (set.c:357) by 0x1BB9AB: btd_device_add_set (device.c:2049) by 0x17FF76: csip_ready (csip.c:243) by 0x1FD5CC: csip_notify_ready (csip.c:546) by 0x1FD5CC: csip_idle (csip.c:630) by 0x1DE20C: idle_notify (gatt-client.c:171) Address 0xc is not stack'd, malloc'd or (recently) free'd
Diffstat
| M | src/shared/gatt-db.c | | | 3 | +++ |
1 files changed, 3 insertions(+), 0 deletions(-)