rpms/bluez
5
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix wordexp() related crasher

Browse Source 
Resolves: RHEL-56021
This commit is contained in:
Bastien Nocera 2025-01-30 14:44:27 +01:00
parent e64f624eb9
commit 5984e0b8f5
2 changed files with 35 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
0001-shared-shell-Free-memory-allocated-by-wordexp.patch
View File

@ -1,4 +1,4 @@
From 9c7ec707e88170adf3e117fe92ed74e311b2e859 Mon Sep 17 00:00:00 2001
From f0febd73bffd78e080499d87dc03eea7622dd876 Mon Sep 17 00:00:00 2001
From: Bastien Nocera <hadess@hadess.net>
Date: Tue, 2 Jul 2024 15:27:12 +0200
Subject: [PATCH] shared/shell: Free memory allocated by wordexp()
@ -57,14 +57,14 @@ bluez-5.76/src/shared/shell.c:1423:4: leaked_storage: Variable "w" going out of
1424| break;
1425| };
---
src/shared/shell.c | 22 ++++++++++++++++------
1 file changed, 16 insertions(+), 6 deletions(-)
src/shared/shell.c | 26 ++++++++++++++++++++------
1 file changed, 20 insertions(+), 6 deletions(-)
diff --git a/src/shared/shell.c b/src/shared/shell.c
index 88ecaa076adc..26c6a419af22 100644
index 73b4c704174a..60d37c9e56a7 100644
--- a/src/shared/shell.c
+++ b/src/shared/shell.c
@@ -452,13 +452,23 @@ static void shell_print_menu_zsh_complete(void)
@@ -498,13 +498,23 @@ static void shell_print_menu_zsh_complete(void)
}
}
@ -89,16 +89,35 @@ index 88ecaa076adc..26c6a419af22 100644
free(str);
return -EINVAL;
}
@@ -537,7 +547,7 @@ static int cmd_exec(const struct bt_shell_menu_entry *entry,
@@ -526,6 +536,7 @@ static int cmd_exec(const struct bt_shell_menu_entry *entry,
char *man, *opt;
int flags = WRDE_NOCMD;
bool optargs = false;
+ size_t saved_wordc = 0;
if (argc == 2 && (!memcmp(argv[1], "help", 4) ||
!memcmp(argv[1], "--help", 6))) {
@@ -583,8 +594,10 @@ static int cmd_exec(const struct bt_shell_menu_entry *entry,
goto fail;
}
- flags |= WRDE_APPEND;
+ flags |= WRDE_APPEND | WRDE_REUSE;
opt = strdup(entry->arg + len + 1);
+ saved_wordc = w.we_wordc;
+ w.we_wordc = 0;
optional:
@@ -1043,7 +1053,7 @@ static char **args_completion(const struct bt_shell_menu_entry *entry, int argc,
if (parse_args(opt, &w, "[]", flags) < 0) {
@@ -598,6 +611,7 @@ optional:
free(opt);
/* Check if there are too many arguments */
+ w.we_wordc += saved_wordc;
if (!optargs && ((unsigned int) argc - 1 > w.we_wordc && !w.we_offs)) {
print_text(COLOR_HIGHLIGHT, "Too many arguments: %d > %zu",
argc - 1, w.we_wordc);
@@ -1089,7 +1103,7 @@ static char **args_completion(const struct bt_shell_menu_entry *entry, int argc,
args.we_offs = 0;
wordfree(&args);
@ -107,7 +126,7 @@ index 88ecaa076adc..26c6a419af22 100644
goto done;
rl_completion_display_matches_hook = NULL;
@@ -1115,7 +1125,7 @@ static char **shell_completion(const char *text, int start, int end)
@@ -1161,7 +1175,7 @@ static char **shell_completion(const char *text, int start, int end)
if (start > 0) {
wordexp_t w;
@ -116,7 +135,7 @@ index 88ecaa076adc..26c6a419af22 100644
return NULL;
matches = menu_completion(default_menu, text, w.we_wordc,
@@ -1417,7 +1427,7 @@ int bt_shell_exec(const char *input)
@@ -1464,7 +1478,7 @@ int bt_shell_exec(const char *input)
if (data.monitor)
bt_log_printf(0xffff, data.name, LOG_INFO, "%s", input);
@ -125,7 +144,7 @@ index 88ecaa076adc..26c6a419af22 100644
switch (err) {
case WRDE_BADCHAR:
return -EBADMSG;
@@ -1427,7 +1437,7 @@ int bt_shell_exec(const char *input)
@@ -1474,7 +1488,7 @@ int bt_shell_exec(const char *input)
case WRDE_NOSPACE:
return -ENOMEM;
case WRDE_CMDSUB:
@ -135,5 +154,5 @@ index 88ecaa076adc..26c6a419af22 100644
break;
};
--
2.45.2
2.48.1

6
bluez.spec
View File

@ -6,7 +6,7 @@
Name: bluez
Version: 5.77
Release: 4%{?dist}
Release: 5%{?dist}
Summary: Bluetooth utilities
License: GPL-2.0-or-later
URL: http://www.bluez.org/
@ -339,6 +339,10 @@ install emulator/btvirt ${RPM_BUILD_ROOT}/%{_libexecdir}/bluetooth/
%{_userunitdir}/obex.service
%changelog
* Thu Jan 30 2025 Bastien Nocera <bnocera@redhat.com> - 5.77-5
- Fix wordexp() related crasher
- Resolves: RHEL-56021
* Thu Aug 29 2024 Bastien Nocera <bnocera@redhat.com> - 5.77-4
- Update gating and rpminspect files
- Related: Jira:RHEL-76183