From: Nagaraj D R <nagaraj.dr@samsung.com>
Date: Fri, 18 May 2018 03:58:16 +0000 (+0530)
Subject: Fix possible invalid memory access
X-Git-Tag: accepted/tizen/unified/20190522.085452~1^2~92
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=refs%2Fchanges%2F90%2F204990%2F1;p=platform%2Fupstream%2Fbluez.git

Fix possible invalid memory access

Uninitialized data is read from local variable 'addr'

Change-Id: I9ad5b9be4a578f5450a08d0aa60a22c530dff8c5
Signed-off-by: Amit Purwar <amit.purwar@samsung.com>
---

diff --git a/client/main.c b/client/main.c
index dc42b82..5fe821c 100644
--- a/client/main.c
+++ b/client/main.c
@@ -1519,6 +1519,19 @@ static void pair_reply(DBusMessage *message, void *user_data)
 	return bt_shell_noninteractive_quit(EXIT_SUCCESS);
 }
 
+static const char *proxy_address(GDBusProxy *proxy)
+{
+	DBusMessageIter iter;
+	const char *addr;
+
+	if (!g_dbus_proxy_get_property(proxy, "Address", &iter))
+		return NULL;
+
+	dbus_message_iter_get_basic(&iter, &addr);
+
+	return addr;
+}
+
 static void cmd_pair(int argc, char *argv[])
 {
 	GDBusProxy *proxy;
@@ -1533,7 +1546,7 @@ static void cmd_pair(int argc, char *argv[])
 		return bt_shell_noninteractive_quit(EXIT_FAILURE);
 	}
 
-	bt_shell_printf("Attempting to pair with %s\n", argv[1]);
+	bt_shell_printf("Attempting to pair with %s\n", proxy_address(proxy));
 }
 
 static void cmd_trust(int argc, char *argv[])
@@ -1548,7 +1561,7 @@ static void cmd_trust(int argc, char *argv[])
 
 	trusted = TRUE;
 
-	str = g_strdup_printf("%s trust", argv[1]);
+	str = g_strdup_printf("%s trust", proxy_address(proxy));
 
 	if (g_dbus_proxy_set_property_basic(proxy, "Trusted",
 					DBUS_TYPE_BOOLEAN, &trusted,
@@ -1572,7 +1585,7 @@ static void cmd_untrust(int argc, char *argv[])
 
 	trusted = FALSE;
 
-	str = g_strdup_printf("%s untrust", argv[1]);
+	str = g_strdup_printf("%s untrust", proxy_address(proxy));
 
 	if (g_dbus_proxy_set_property_basic(proxy, "Trusted",
 					DBUS_TYPE_BOOLEAN, &trusted,
@@ -1596,7 +1609,7 @@ static void cmd_block(int argc, char *argv[])
 
 	blocked = TRUE;
 
-	str = g_strdup_printf("%s block", argv[1]);
+	str = g_strdup_printf("%s block", proxy_address(proxy));
 
 	if (g_dbus_proxy_set_property_basic(proxy, "Blocked",
 					DBUS_TYPE_BOOLEAN, &blocked,
@@ -1620,7 +1633,7 @@ static void cmd_unblock(int argc, char *argv[])
 
 	blocked = FALSE;
 
-	str = g_strdup_printf("%s unblock", argv[1]);
+	str = g_strdup_printf("%s unblock", proxy_address(proxy));
 
 	if (g_dbus_proxy_set_property_basic(proxy, "Blocked",
 					DBUS_TYPE_BOOLEAN, &blocked,
@@ -1778,16 +1791,8 @@ static void cmd_disconn(int argc, char *argv[])
 		return bt_shell_noninteractive_quit(EXIT_FAILURE);
 	}
 
-	if (argc < 2 || strlen(argv[1]) == 0) {
-		DBusMessageIter iter;
-
-		if (g_dbus_proxy_get_property(proxy, "Address", &iter) == TRUE) {
-			const char *addr;
-			dbus_message_iter_get_basic(&iter, &addr);
-			bt_shell_printf("Attempting to disconnect from %s\n", addr);
-		}
-	} else
-		bt_shell_printf("Attempting to disconnect from %s\n", argv[1]);
+	bt_shell_printf("Attempting to disconnect from %s\n",
+						proxy_address(proxy));
 }
 
 static void cmd_list_attributes(int argc, char *argv[])