client: Fix possible stack corruption
authorŁukasz Rymanowski <lukasz.rymanowski@codecoup.pl>
Thu, 7 May 2020 21:45:37 +0000 (23:45 +0200)
committerAyush Garg <ayush.garg@samsung.com>
Mon, 12 Apr 2021 09:00:49 +0000 (14:30 +0530)
DBUS_TYPE_BOOLEAN is 'int', which does not have to be the same size as
'bool'.
On architecture where bool is smaller than in, getting prepare-authorize
will corrupt the stack

Signed-off-by: Anuj Jain <anuj01.jain@samsung.com>
Signed-off-by: Ayush Garg <ayush.garg@samsung.com>
client/gatt.c

index ca63c23..c7a8ca4 100755 (executable)
@@ -1859,9 +1859,12 @@ static int parse_options(DBusMessageIter *iter, uint16_t *offset, uint16_t *mtu,
                } else if (strcasecmp(key, "prepare-authorize") == 0) {
                        if (var != DBUS_TYPE_BOOLEAN)
                                return -EINVAL;
-                       if (prep_authorize)
-                               dbus_message_iter_get_basic(&value,
-                                                               prep_authorize);
+                       if (prep_authorize) {
+                               int tmp;
+
+                               dbus_message_iter_get_basic(&value, &tmp);
+                               *prep_authorize = !!tmp;
+                       }
                }
 
                dbus_message_iter_next(&dict);