a2dp: Fix crash when SEP codec has not been initialized
authorLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
Mon, 23 Nov 2020 18:20:06 +0000 (10:20 -0800)
committerAyush Garg <ayush.garg@samsung.com>
Fri, 11 Mar 2022 13:38:34 +0000 (19:08 +0530)
If SEP has not been properly discovered avdtp_get_codec may return NULL
thus causing crashes such as:

https://github.com/bluez/bluez/issues/57
Signed-off-by: Anuj Jain <anuj01.jain@samsung.com>
Signed-off-by: Ayush Garg <ayush.garg@samsung.com>
profiles/audio/a2dp.c

index 7cbc8e4..e05e939 100644 (file)
@@ -2013,8 +2013,8 @@ static void register_remote_sep(void *data, void *user_data)
                                sep, remote_sep_free) == FALSE) {
                error("Could not register remote sep %s", sep->path);
                free(sep->path);
-               sep->path = NULL;
-               goto done;
+               free(sep);
+               return;
        }
 
        DBG("Found remote SEP: %s", sep->path);
@@ -2845,10 +2845,15 @@ static void store_remote_sep(void *data, void *user_data)
        GKeyFile *key_file = user_data;
        char seid[4], value[256];
        struct avdtp_service_capability *service = avdtp_get_codec(sep->sep);
-       struct avdtp_media_codec_capability *codec = (void *) service->data;
+       struct avdtp_media_codec_capability *codec;
        unsigned int i;
        ssize_t offset;
 
+       if (!service)
+               return;
+
+       codec = (void *) service->data;
+
        sprintf(seid, "%02hhx", avdtp_get_seid(sep->sep));
 
        offset = sprintf(value, "%02hhx:%02hhx:%02hhx:",