[PATCH] Fix potential bug in le_advertising_report()
From: Andre Guedes <hidden>
Date: 2011-02-22 17:44:29
Subsystem:
the rest · Maintainer:
Linus Torvalds
In the current implementation of le_advertising_report(), the variable 'info' has an invalid memory address after the 'for' loop. If 'info' is dereferenced it will access invalid memory. This patch fixes this potential bug and improves the code's readability. --- plugins/hciops.c | 15 ++++++++++----- 1 files changed, 10 insertions(+), 5 deletions(-)
diff --git a/plugins/hciops.c b/plugins/hciops.c
index c3d6290..fd19ef4 100644
--- a/plugins/hciops.c
+++ b/plugins/hciops.c@@ -2184,14 +2184,19 @@ static inline void le_advertising_report(int index, evt_le_meta_event *meta) { struct dev_info *dev = &devs[index]; le_advertising_info *info; - uint8_t num, i; + uint8_t num_reports; + const uint8_t RSSI_SIZE = 1; - num = meta->data[0]; - info = (le_advertising_info *) (meta->data + 1); + num_reports = meta->data[0]; - for (i = 0; i < num; i++) { + info = (le_advertising_info *) &meta->data[1]; + btd_event_advertising_report(&dev->bdaddr, info); + num_reports--; + + while (num_reports--) { + info = (le_advertising_info *) (info->data + info->length + + RSSI_SIZE); btd_event_advertising_report(&dev->bdaddr, info); - info = (le_advertising_info *) (info->data + info->length + 1); } }
--
1.7.1