[BlueZ,v1,1/4] health: mcap: add checks for NULL mcap_notify_error()

Commit Message

Roman Smirnov July 9, 2024, noon UTC

It is necessary to prevent dereferencing of NULL pointers.

Found with the SVACE static analysis tool.
---
 profiles/health/mcap.c | 9 +++++++++
 1 file changed, 9 insertions(+)

Comments

[e-mail] July 9, 2024, 3:11 p.m. UTC | #1

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=869638

---Test result---

Test Summary:
CheckPatch                    PASS      1.90 seconds
GitLint                       PASS      1.32 seconds
BuildEll                      PASS      24.56 seconds
BluezMake                     PASS      1667.59 seconds
MakeCheck                     PASS      13.11 seconds
MakeDistcheck                 PASS      179.03 seconds
CheckValgrind                 PASS      255.48 seconds
CheckSmatch                   PASS      357.30 seconds
bluezmakeextell               PASS      121.14 seconds
IncrementalBuild              PASS      6078.28 seconds
ScanBuild                     PASS      1030.01 seconds



---
Regards,
Linux Bluetooth

Patch

diff --git a/profiles/health/mcap.c b/profiles/health/mcap.c
index 7eceaa88a..2e4214a69 100644
--- a/profiles/health/mcap.c
+++ b/profiles/health/mcap.c
@@ -336,6 +336,9 @@  static void mcap_notify_error(struct mcap_mcl *mcl, GError *err)
 	case MCAP_MD_CREATE_MDL_REQ:
 		st = MDL_WAITING;
 		l = g_slist_find_custom(mcl->mdls, &st, cmp_mdl_state);
+		if (!l)
+			return;
+
 		mdl = l->data;
 		mcl->mdls = g_slist_remove(mcl->mdls, mdl);
 		mcap_mdl_unref(mdl);
@@ -345,6 +348,9 @@  static void mcap_notify_error(struct mcap_mcl *mcl, GError *err)
 	case MCAP_MD_ABORT_MDL_REQ:
 		st = MDL_WAITING;
 		l = g_slist_find_custom(mcl->mdls, &st, cmp_mdl_state);
+		if (!l)
+			return;
+
 		shutdown_mdl(l->data);
 		update_mcl_state(mcl);
 		con->cb.notify(err, con->user_data);
@@ -362,6 +368,9 @@  static void mcap_notify_error(struct mcap_mcl *mcl, GError *err)
 	case MCAP_MD_RECONNECT_MDL_REQ:
 		st = MDL_WAITING;
 		l = g_slist_find_custom(mcl->mdls, &st, cmp_mdl_state);
+		if (!l)
+			return;
+
 		shutdown_mdl(l->data);
 		update_mcl_state(mcl);
 		con->cb.op(NULL, err, con->user_data);