Fix memory corruption 14/149414/1
authorSeungyoun Ju <sy39.ju@samsung.com>
Wed, 29 Mar 2017 10:29:19 +0000 (19:29 +0900)
committerSeungyoun Ju <sy39.ju@samsung.com>
Tue, 12 Sep 2017 08:05:01 +0000 (17:05 +0900)
Already freed memory is accessed and is tried to free again.
It causes memory corruption so that at the next time glib memory use,
crash happens.

[Valgrind]
==918== Invalid free() / delete / delete[] / realloc()
==918==    at 0x483403C: free (vg_replace_malloc.c:469)
==918==    by 0x4D03467: g_free (gmem.c:252)
==918==    by 0x4D10BBB: g_slice_free_chain_with_offset (gslice.c:1206)
==918==    by 0x49A1C79: _bt_gatt_client_update_services (bluetooth-gatt.c:199)
==918==    by 0x498D691: __bt_event_proxy (bluetooth-common.c:1783)
==918==    by 0x68E0959: _bt_common_event_cb (bt-common.c:139)
==918==    by 0x6901B6D: __bt_device_event_filter (bt-event-handler.c:708)
==918==    by 0x48F9661: emit_signal_instance_in_idle_cb (gdbusconnection.c:3665)
==918==    by 0x4CFDFCD: g_idle_dispatch (gmain.c:4657)
==918==    by 0x4CFF7A7: g_main_context_dispatch (gmain.c:2539)
==918==    by 0x4C1FCA5: _ecore_glib_select (ecore_glib.c:171)
==918==    by 0x4C1AB4D: _ecore_main_select (ecore_main.c:1466)
==918==    by 0x4C1B5A5: _ecore_main_loop_iterate_internal (ecore_main.c:1894)
==918==    by 0x4C1B877: ecore_main_loop_begin (ecore_main.c:956)
==918==    by 0x10CA95: main (main.c:117)
==918==  Address 0x95f72b0 is 0 bytes inside a block of size 8 free'd
==918==    at 0x483403C: free (vg_replace_malloc.c:469)
==918==    by 0x4D03467: g_free (gmem.c:252)
==918==    by 0x4D1115B: g_slist_remove (gslist.c:425)
==918==    by 0x49A02D1: bt_gatt_service_destroy (bluetooth-gatt.c:937)
==918==    by 0x4D113E7: g_slist_foreach (gslist.c:840)
==918==    by 0x4D113F9: g_slist_free_full (gslist.c:177)
==918==    by 0x49A1C79: _bt_gatt_client_update_services (bluetooth-gatt.c:199)
==918==    by 0x498D691: __bt_event_proxy (bluetooth-common.c:1783)
==918==    by 0x68E0959: _bt_common_event_cb (bt-common.c:139)
==918==    by 0x6901B6D: __bt_device_event_filter (bt-event-handler.c:708)
==918==    by 0x48F9661: emit_signal_instance_in_idle_cb (gdbusconnection.c:3665)
==918==    by 0x4CFDFCD: g_idle_dispatch (gmain.c:4657)
==918==    by 0x4CFF7A7: g_main_context_dispatch (gmain.c:2539)
==918==    by 0x4C1FCA5: _ecore_glib_select (ecore_glib.c:171)
==918==    by 0x4C1AB4D: _ecore_main_select (ecore_main.c:1466)
==918==    by 0x4C1B5A5: _ecore_main_loop_iterate_internal (ecore_main.c:1894)
==918==    by 0x4C1B877: ecore_main_loop_begin (ecore_main.c:956)
==918==    by 0x10CA95: main (main.c:117)

Change-Id: Ie89cdf0f23a86f128c56254aea3e707cb84e4351
Signed-off-by: Seungyoun Ju <sy39.ju@samsung.com>
src/bluetooth-common.c
src/bluetooth-gatt.c

index 17381233e1a55ed2bcf01aac53c7715bb83e6071..94250f0ebe42854fda80351f3c9eb8bed0512d31 100644 (file)
@@ -57,8 +57,6 @@ static void __bt_free_tds_scan_result_info_s(bt_tds_transport_block_list_s *disc
 
 static int __bt_get_bt_adapter_le_device_discovery_info_s(bt_adapter_le_device_discovery_info_s **le_discovery_info, bluetooth_le_device_info_t *source_info);
 static void __bt_free_bt_adapter_le_device_discovery_info_s(bt_adapter_le_device_discovery_info_s *discovery_info);
-static int __bt_gatt_client_update_characteristics(bt_gatt_handle_info_t char_handles, bt_gatt_service_s *service);
-static int __bt_gatt_client_update_descriptors(bt_gatt_handle_info_t desc_handles, bt_gatt_characteristic_s *characteristic);
 
 /*
  *  Public Functions
@@ -3445,244 +3443,6 @@ static void __bt_convert_lower_to_upper(char *origin)
                        origin[i] = toupper(origin[i]);
        }
 }
-
-static void bt_gatt_client_handle_destroy(bt_gatt_h gatt_handle)
-{
-       bt_gatt_common_s *handle = (bt_gatt_common_s *)gatt_handle;
-
-       if (handle) {
-               if (handle->type == BT_GATT_TYPE_SERVICE)
-                       bt_gatt_service_destroy(gatt_handle);
-               else if (handle->type == BT_GATT_TYPE_CHARACTERISTIC)
-                       bt_gatt_characteristic_destroy(gatt_handle);
-               else if (handle->type == BT_GATT_TYPE_DESCRIPTOR)
-                       bt_gatt_descriptor_destroy(gatt_handle);
-               else
-                       BT_ERR("Type is invalid(type:%d)", handle->type);
-       }
-}
-
-int _bt_gatt_client_update_all(bt_gatt_client_h client)
-{
-       bt_gatt_client_s *client_s = client;
-       bluetooth_device_address_t addr_hex = { {0, } };
-       bt_gatt_handle_info_t *prim_svc = NULL;
-       int ret;
-       int i;
-       int j;
-       GSList *svc_list = NULL;
-
-       prim_svc = g_new0(bt_gatt_handle_info_t, 1);
-
-       _bt_convert_address_to_hex(&addr_hex, client_s->remote_address);
-       ret = bluetooth_gatt_get_primary_services(&addr_hex, prim_svc);
-       ret = _bt_get_error_code(ret);
-       if (ret != BT_ERROR_NONE) {
-               BT_ERR("bluetooth_gatt_get_primary_services is failed");
-               g_free(prim_svc);
-               return ret;
-       }
-
-       if (prim_svc->count == 0)
-               goto done;
-
-       for (i = 0; i < prim_svc->count; i++) {
-               bt_gatt_service_s *svc = NULL;
-               bt_gatt_service_property_t property;
-
-               if (prim_svc->handle[i] == NULL)
-                       continue;
-               BT_DBG("handle: %s", prim_svc->handle[i]);
-
-               memset(&property, 0x00, sizeof(property));
-
-               ret = bluetooth_gatt_get_service_property(
-                               prim_svc->handle[i], &property);
-               ret = _bt_get_error_code(ret);
-               if (ret != BT_ERROR_NONE) {
-                       BT_ERR("bluetooth_gatt_get_service_property is failed");
-                       continue;
-               }
-
-               /* Add primary service */
-               ret = bt_gatt_service_create(property.uuid,
-                               BT_GATT_SERVICE_TYPE_PRIMARY,
-                               (bt_gatt_h *)&svc);
-               if (ret != BT_ERROR_NONE) {
-                       BT_ERR("bt_gatt_service_create is failed");
-                       continue;
-               }
-
-               svc->role = BT_GATT_ROLE_CLIENT;
-               svc->parent = (void *)client_s;
-               svc->path = g_strdup(prim_svc->handle[i]);
-
-               svc_list = g_slist_append(svc_list, svc);
-
-               if (property.include_handles.count != 0 && property.include_handles.handle) {
-                       GSList *include_list = NULL;
-                       /* Add included services */
-                       for (j = 0; j < property.include_handles.count; j++) {
-                               bt_gatt_service_s *sec_svc = NULL;
-                               bt_gatt_service_property_t sec_property;
-
-                               if (property.include_handles.handle[j] == NULL)
-                                       continue;
-
-                               memset(&sec_property, 0x00, sizeof(sec_property));
-
-                               ret = bluetooth_gatt_get_service_property(
-                                               property.include_handles.handle[j],
-                                               &sec_property);
-                               ret = _bt_get_error_code(ret);
-                               if (ret != BT_ERROR_NONE)
-                                       continue;
-
-                               ret = bt_gatt_service_create(sec_property.uuid,
-                                               BT_GATT_SERVICE_TYPE_SECONDARY,
-                                               (bt_gatt_h *)&sec_svc);
-                               if (ret != BT_ERROR_NONE)
-                                       continue;
-
-                               sec_svc->role = BT_GATT_ROLE_CLIENT;
-                               sec_svc->parent = (void *)svc;
-                               sec_svc->is_included_service = true;
-                               sec_svc->path = g_strdup(property.include_handles.handle[j]);
-
-                               include_list = g_slist_append(include_list, sec_svc);
-                               bluetooth_gatt_free_service_property(&sec_property);
-                       }
-
-                       g_slist_free_full(svc->included_services,
-                                       bt_gatt_client_handle_destroy);
-                       svc->included_services = include_list;
-               }
-               if (property.char_handle.count != 0 && property.char_handle.handle) {
-
-                       /* Add characteristics */
-                       __bt_gatt_client_update_characteristics(property.char_handle, svc);
-               }
-               bluetooth_gatt_free_service_property(&property);
-       }
-       g_strfreev(prim_svc->handle);
-
-       g_free(prim_svc);
-       prim_svc = NULL;
-
-       if (svc_list == NULL)
-               return BT_ERROR_OPERATION_FAILED;
-
-done:
-       g_slist_free_full(client_s->services,
-                       bt_gatt_client_handle_destroy);
-
-       client_s->services = svc_list;
-       g_free(prim_svc);
-
-       return BT_ERROR_NONE;
-}
-
-static int __bt_gatt_client_update_characteristics(bt_gatt_handle_info_t char_handles,
-               bt_gatt_service_s *service)
-{
-       GSList *chr_list = NULL;
-       int i;
-
-       for (i = 0; i < char_handles.count; i++) {
-               bt_gatt_characteristic_s *chr = NULL;
-               bt_gatt_char_property_t char_property;
-               int ret;
-
-               memset(&char_property, 0x00, sizeof(char_property));
-               ret = bluetooth_gatt_get_characteristics_property(
-                               char_handles.handle[i], &char_property);
-               ret = _bt_get_error_code(ret);
-               if (ret != BT_ERROR_NONE) {
-                       BT_ERR("bluetooth_gatt_get_characteristics_property is failed");
-                       goto next;
-               }
-
-               ret = bt_gatt_characteristic_create(char_property.uuid, 0,
-                               char_property.permission, (char *)char_property.val,
-                               (int)char_property.val_len, (bt_gatt_h *)&chr);
-               if (ret != BT_ERROR_NONE) {
-                       BT_ERR("bt_gatt_characteristic_create is failed");
-                       goto next;
-               }
-
-               if (char_property.permission & BT_GATT_PROPERTY_WRITE_WITHOUT_RESPONSE)
-                       chr->write_type = BT_GATT_WRITE_TYPE_WRITE_NO_RESPONSE;
-               else if (char_property.permission & BT_GATT_PROPERTY_WRITE)
-                       chr->write_type = BT_GATT_WRITE_TYPE_WRITE;
-
-               chr->path = g_strdup(char_handles.handle[i]);
-               BT_DBG("path : %s", chr->path);
-               chr->parent = (void *)service;
-               chr->role = BT_GATT_ROLE_CLIENT;
-
-               if (char_property.char_desc_handle.count != 0 && char_property.char_desc_handle.handle) {
-
-                       /* Add characteristics descriptor */
-                       __bt_gatt_client_update_descriptors(char_property.char_desc_handle, chr);
-               }
-
-               chr_list = g_slist_append(chr_list, chr);
-next:
-               bluetooth_gatt_free_char_property(&char_property);
-       }
-
-       g_slist_free_full(service->characteristics,
-                       bt_gatt_client_handle_destroy);
-       service->characteristics = chr_list;
-       return BT_ERROR_NONE;
-}
-
-static int __bt_gatt_client_update_descriptors(bt_gatt_handle_info_t desc_handles,
-               bt_gatt_characteristic_s *characteristic)
-
-{
-       GSList *desc_list = NULL;
-       int i;
-
-       /* Add characteristics descriptor */
-
-       for (i = 0; i < desc_handles.count; i++) {
-               bt_gatt_descriptor_s *desc = NULL;
-               bt_gatt_char_descriptor_property_t desc_property;
-               int ret;
-
-               memset(&desc_property, 0x00, sizeof(desc_property));
-               ret = bluetooth_gatt_get_char_descriptor_property(
-                               desc_handles.handle[i], &desc_property);
-               ret = _bt_get_error_code(ret);
-               if (ret != BT_ERROR_NONE) {
-                       BT_ERR("bluetooth_gatt_get_char_descriptor_property is failed");
-                       goto next;
-               }
-
-               ret = bt_gatt_descriptor_create(desc_property.uuid, 0,
-                                       (char *)desc_property.val, (int)desc_property.val_len,
-                                       (bt_gatt_h *)&desc);
-
-               if (ret != BT_ERROR_NONE) {
-                       BT_ERR("bt_gatt_characteristic_create is failed");
-                       goto next;
-               }
-               desc->path = g_strdup(desc_handles.handle[i]);
-               BT_DBG("path : %s", desc->path);
-               desc->parent = (void *)characteristic;
-               desc->role = BT_GATT_ROLE_CLIENT;
-               desc_list = g_slist_append(desc_list, desc);
-
-next:
-               bluetooth_gatt_free_desc_property(&desc_property);
-       }
-
-       g_slist_free_full(characteristic->descriptors,
-                       bt_gatt_client_handle_destroy);
-       characteristic->descriptors = desc_list;
-       return BT_ERROR_NONE;
-}
 /* LCOV_EXCL_STOP */
 
 tizen_profile_t profile = _PROFILE_UNKNOWN;
index 496be3651b72cb33bf41e788b67cf6227938f15b..199b9739e9e5311fad7d71c85c250ba82908d9a9 100644 (file)
@@ -32,8 +32,11 @@ static GSList *gatt_server_list = NULL;
 static bool is_gatt_server_initialized = false;
 static bool is_gatt_server_started = false;
 
-bt_gatt_service_s* __bt_gatt_service_create(const char *uuid,
-                               bt_gatt_service_type_e type);
+static bt_gatt_service_s* __bt_gatt_service_create(const char *uuid,
+                                                  bt_gatt_service_type_e type);
+static void __bt_gatt_free_descriptor(bt_gatt_h gatt_handle);
+static void __bt_gatt_free_characteristic(bt_gatt_h gatt_handle);
+static void __bt_gatt_free_service(bt_gatt_h gatt_handle);
 
 #define BT_CHECK_GATT_SUPPORT() \
 { \
@@ -50,7 +53,7 @@ bt_gatt_service_s* __bt_gatt_service_create(const char *uuid,
 }
 
 /* LCOV_EXCL_START */
-int __bt_check_gatt_server_init_status(void)
+static int __bt_check_gatt_server_init_status(void)
 {
        if (is_gatt_server_initialized != true) {
                BT_ERR("NOT_INITIALIZED(0x%08x)", BT_ERROR_NOT_INITIALIZED);
@@ -127,18 +130,6 @@ const GSList* _bt_gatt_get_server_list(void)
        return gatt_server_list;
 }
 
-static void __bt_gatt_client_handle_destroy(bt_gatt_h gatt_handle)
-{
-       bt_gatt_common_s *handle = (bt_gatt_common_s*)gatt_handle;
-
-       if (handle->type == BT_GATT_TYPE_SERVICE)
-               bt_gatt_service_destroy(gatt_handle);
-       else if (handle->type == BT_GATT_TYPE_CHARACTERISTIC)
-               bt_gatt_characteristic_destroy(gatt_handle);
-       else if (handle->type == BT_GATT_TYPE_DESCRIPTOR)
-               bt_gatt_descriptor_destroy(gatt_handle);
-}
-
 bt_gatt_h _bt_gatt_client_add_service(bt_gatt_client_h client, const char *path)
 {
        int ret;
@@ -201,8 +192,7 @@ int _bt_gatt_client_update_services(bt_gatt_client_h client)
                return ret;
        }
 
-       g_slist_free_full(client_s->services,
-                       __bt_gatt_client_handle_destroy);
+       g_slist_free_full(client_s->services, __bt_gatt_free_service);
        client_s->services = NULL;
 
        if (prim_svc.count == 0) {
@@ -269,8 +259,7 @@ next:
        g_strfreev(svc->include_handles);
        svc->include_handles = NULL;
 
-       g_slist_free_full(svc->included_services,
-                       __bt_gatt_client_handle_destroy);
+       g_slist_free_full(svc->included_services, __bt_gatt_free_service);
 
        svc->included_services = include_list;
 
@@ -332,8 +321,7 @@ next:
        g_strfreev(svc->char_handles);
        svc->char_handles = NULL;
 
-       g_slist_free_full(svc->characteristics,
-                       __bt_gatt_client_handle_destroy);
+       g_slist_free_full(svc->characteristics, __bt_gatt_free_characteristic);
 
        svc->characteristics = chr_list;
 
@@ -388,8 +376,7 @@ next:
        g_strfreev(chr->desc_handles);
        chr->desc_handles = NULL;
 
-       g_slist_free_full(chr->descriptors,
-                       __bt_gatt_client_handle_destroy);
+       g_slist_free_full(chr->descriptors, __bt_gatt_free_descriptor);
 
        chr->descriptors = desc_list;
 
@@ -1673,7 +1660,7 @@ int bt_gatt_get_type(bt_gatt_h gatt_handle, bt_gatt_type_e *gatt_type)
        return BT_ERROR_NONE; /* LCOV_EXCL_LINE */
 }
 
-bt_gatt_service_s* __bt_gatt_service_create(const char *uuid,
+static bt_gatt_service_s* __bt_gatt_service_create(const char *uuid,
                                bt_gatt_service_type_e type)
 {
        bt_gatt_service_s *svc;