qemu/hw/bt
Paolo Bonzini 393c13b940 bt: stop the sdp memory allocation craziness
Clang static analyzer reports a memory leak.  Actually, the allocated
memory escapes here:

        record->attribute_list[record->attributes].pair = data;

but clang is correct that the memory might leak if len is zero.  We
know it isn't; assert that it is the case.

The craziness doesn't end there.  The memory is freed by
bt_l2cap_sdp_close_ch:

       g_free(sdp->service_list[i].attribute_list->pair);

which actually should have been written like this:

       g_free(sdp->service_list[i].attribute_list[0].pair);

The attribute_list is sorted with qsort; but indeed the first
entry of attribute_list should point to "data" even after the qsort,
because the first record has id SDP_ATTR_RECORD_HANDLE, whose
numeric value is zero.

But hang on.  The qsort function is

    static int sdp_attributeid_compare(
                const struct sdp_service_attribute_s *a,
                const struct sdp_service_attribute_s *b)
    {
        return (int) b->attribute_id - a->attribute_id;
    }

but no one ever writes attribute_id.  So it only works if qsort is
stable, and who knows what else is broken, but we can fix it by
setting attribute_id in the while loop.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-08-01 17:27:33 +02:00
..
core.c hw: Clean up includes 2016-01-29 15:07:25 +00:00
hci-csr.c be-hci: use backend functions 2017-06-02 11:33:53 +04:00
hci.c hw/bt/hci: spelling fix: endianness 2016-09-13 18:12:34 +03:00
hid.c hw: Clean up includes 2016-01-29 15:07:25 +00:00
l2cap.c hw/bt: Don't use cpu_to_*w() and *_to_cpup() 2016-07-12 15:08:53 +01:00
Makefile.objs hw: move target-independent files to subdirectories 2013-04-08 18:13:12 +02:00
sdp.c bt: stop the sdp memory allocation craziness 2017-08-01 17:27:33 +02:00