[pulseaudio-commits] 2 commits - src/modules

[Peter Meerwald]

 src/modules/bluetooth/backend-native.c |    8 +++++---
 src/modules/bluetooth/bluez4-util.c    |   10 +++++-----
 2 files changed, 10 insertions(+), 8 deletions(-)

New commits:
commit 492aafd93d871cff9b4f21bee68afa52c46a4474
Author: Peter Meerwald-Stadler <pmeerw at pmeerw.net>
Date:   Tue Aug 16 15:56:40 2016 +0200

    bluetooth: Fix negative array index write
    
    CID 1533121

diff --git a/src/modules/bluetooth/backend-native.c b/src/modules/bluetooth/backend-native.c
index 86376c0..cf88126 100644
--- a/src/modules/bluetooth/backend-native.c
+++ b/src/modules/bluetooth/backend-native.c
@@ -231,14 +231,17 @@ static void rfcomm_io_callback(pa_mainloop_api *io, pa_io_event *e, int fd, pa_i
         ssize_t len;
         int gain;
 
-        len = read(fd, buf, 511);
+        len = pa_read(fd, buf, 511, NULL);
+        if (len < 0) {
+            pa_log_error("RFCOMM read error: %s", pa_cstrerror(errno));
+            goto fail;
+        }
         buf[len] = 0;
         pa_log_debug("RFCOMM << %s", buf);
 
         if (sscanf(buf, "AT+VGS=%d", &gain) == 1) {
           t->speaker_gain = gain;
           pa_hook_fire(pa_bluetooth_discovery_hook(t->device->discovery, PA_BLUETOOTH_HOOK_TRANSPORT_SPEAKER_GAIN_CHANGED), t);
-
         } else if (sscanf(buf, "AT+VGM=%d", &gain) == 1) {
           t->microphone_gain = gain;
           pa_hook_fire(pa_bluetooth_discovery_hook(t->device->discovery, PA_BLUETOOTH_HOOK_TRANSPORT_MICROPHONE_GAIN_CHANGED), t);
@@ -259,7 +262,6 @@ static void rfcomm_io_callback(pa_mainloop_api *io, pa_io_event *e, int fd, pa_i
 fail:
     pa_bluetooth_transport_unlink(t);
     pa_bluetooth_transport_free(t);
-    return;
 }
 
 static void transport_destroy(pa_bluetooth_transport *t) {

commit aa1882c93f8a001880d8a51f48f2efee1221c090
Author: Peter Meerwald-Stadler <pmeerw at pmeerw.net>
Date:   Tue Aug 16 15:33:24 2016 +0200

    bluetooth: Reorganize code to avoid Coverity NULL dereference warning
    
    CID 1353122
    
    this is a false-positive because
    
       if (dbus_message_has_interface(p->message, "org.bluez.Manager") ||
            dbus_message_has_interface(p->message, "org.bluez.Adapter"))
            d = NULL;
        else if (!(d = pa_hashmap_get(y->devices, dbus_message_get_path(p->message)))) {
            pa_log_warn("Received GetProperties() reply from unknown device: %s (device removed?)",
    dbus_message_get_path(p->message));
            goto finish2;
        }
    
    d can be NULL only if p->message interface is org.bluez.Manager or
    org.bluez.Adapter. If
    
        dbus_message_is_method_call(p->message, "org.bluez.Device", "GetProperties")
    
    returns true, we know that the interface is org.bluez.Device.
    
    thanks, Tanu!

diff --git a/src/modules/bluetooth/bluez4-util.c b/src/modules/bluetooth/bluez4-util.c
index 3793898..542ce35 100644
--- a/src/modules/bluetooth/bluez4-util.c
+++ b/src/modules/bluetooth/bluez4-util.c
@@ -657,13 +657,13 @@ static void get_properties_reply(DBusPendingCall *pending, void *userdata) {
 
     pa_assert(p->call_data == d);
 
-    if (d != NULL)
+    if (d != NULL) {
         old_any_connected = pa_bluez4_device_any_audio_connected(d);
+        valid = dbus_message_get_type(r) == DBUS_MESSAGE_TYPE_ERROR ? -1 : 1;
 
-    valid = dbus_message_get_type(r) == DBUS_MESSAGE_TYPE_ERROR ? -1 : 1;
-
-    if (dbus_message_is_method_call(p->message, "org.bluez.Device", "GetProperties"))
-        d->device_info_valid = valid;
+        if (dbus_message_is_method_call(p->message, "org.bluez.Device", "GetProperties"))
+            d->device_info_valid = valid;
+    }
 
     if (dbus_message_is_error(r, DBUS_ERROR_SERVICE_UNKNOWN)) {
         pa_log_debug("Bluetooth daemon is apparently not available.");