@@ -330,7 +330,8 @@ static void print_packet(struct timeval *tv, struct ucred *cred, char ident,
if ((filter_mask & PACKET_FILTER_SHOW_INDEX) &&
index != HCI_DEV_NONE) {
if (use_color()) {
- n = sprintf(ts_str + ts_pos, "%s", COLOR_INDEX_LABEL);
+ n = snprintf(ts_str + ts_pos, sizeof(ts_str) - ts_pos,
+ "%s", COLOR_INDEX_LABEL);
if (n > 0)
ts_pos += n;
}
@@ -73,7 +73,7 @@ static void prepare_filesystem(void)
if (!is_init)
return;
- for (i = 0; mount_table[i].fstype; i++) {
+ for (i = 0; mount_table[i].fstype && mount_table[i].target; i++) {
struct stat st;
if (lstat(mount_table[i].target, &st) < 0) {
@@ -1338,9 +1338,12 @@ static gboolean a2dp_reconfigure(gpointer data)
if (setup->rsep) {
cap = avdtp_get_codec(setup->rsep->sep);
rsep_codec = (struct avdtp_media_codec_capability *) cap->data;
+ /* Check that codec really match after closing */
+ if (sep->codec != rsep_codec->media_codec_type)
+ setup->rsep = NULL;
}
- if (!setup->rsep || sep->codec != rsep_codec->media_codec_type)
+ if (!setup->rsep)
setup->rsep = find_remote_sep(setup->chan, sep);
if (!setup->rsep) {
@@ -1177,7 +1177,7 @@ static int uinput_create(struct btd_device *device, const char *name,
memset(&dev, 0, sizeof(dev));
if (name) {
- strncpy(dev.name, name, UINPUT_MAX_NAME_SIZE);
+ strncpy(dev.name, name, UINPUT_MAX_NAME_SIZE - 1);
dev.name[UINPUT_MAX_NAME_SIZE - 1] = '\0';
}
@@ -108,7 +108,7 @@ static int bnep_connadd(int sk, uint16_t role, char *dev)
struct bnep_connadd_req req;
memset(&req, 0, sizeof(req));
- strncpy(req.device, dev, 16);
+ strncpy(req.device, dev, 15);
req.device[15] = '\0';
req.sock = sk;
@@ -345,7 +345,7 @@ struct bnep *bnep_new(int sk, uint16_t local_role, uint16_t remote_role,
session->io = g_io_channel_unix_new(dup_fd);
session->src = local_role;
session->dst = remote_role;
- strncpy(session->iface, iface, 16);
+ strncpy(session->iface, iface, 15);
session->iface[15] = '\0';
g_io_channel_set_close_on_unref(session->io, TRUE);
@@ -1119,8 +1119,6 @@ static void read_multiple_cb(struct bt_att_chan *chan, uint8_t opcode,
}
data = read_mult_data_new(server, chan, opcode, length / 2);
- if (!data)
- goto error;
for (i = 0; i < data->num_handles; i++)
data->handles[i] = get_le16(pdu + i * 2);
@@ -41,9 +41,14 @@ void print_byte_array(const char *prefix, const void *ptr, int len)
char *line, *bytes;
int i;
- line = g_malloc(strlen(prefix) + (16 * 3) + 2);
- sprintf(line, "%s ", prefix);
- bytes = line + strlen(prefix) + 1;
+ if (prefix) {
+ line = g_malloc(strlen(prefix) + (16 * 3) + 2);
+ sprintf(line, "%s ", prefix);
+ bytes = line + strlen(prefix) + 1;
+ } else {
+ line = g_malloc((16 * 3) + 2);
+ bytes = line + 1;
+ }
for (i = 0; i < len; ++i) {
sprintf(bytes, "%2.2x ", data[i]);
@@ -136,7 +136,7 @@ static void prepare_sandbox(void)
{
int i;
- for (i = 0; mount_table[i].fstype; i++) {
+ for (i = 0; mount_table[i].fstype && mount_table[i].target; i++) {
struct stat st;
if (lstat(mount_table[i].target, &st) < 0) {
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> This fixes various issues found when sanitizers are enabled. --- monitor/packet.c | 3 ++- peripheral/main.c | 2 +- profiles/audio/a2dp.c | 5 ++++- profiles/audio/avctp.c | 2 +- profiles/network/bnep.c | 4 ++-- src/shared/gatt-server.c | 2 -- tools/mesh-gatt/util.c | 11 ++++++++--- tools/test-runner.c | 2 +- 8 files changed, 19 insertions(+), 12 deletions(-)