| Message ID | 20180530125314.11677-1-fli@suse.com |
|---|---|
| State | New |
| Headers | show |
| Series | fix Segmentation fault when emulating a bluetooth device 'dev' | expand |
diff --git a/hw/bt/hid.c b/hw/bt/hid.c index 056291f9b5..dfb0ea9c9b 100644 --- a/hw/bt/hid.c +++ b/hw/bt/hid.c @@ -174,6 +174,9 @@ static void bt_hid_send_data(struct bt_l2cap_conn_params_s *ch, int type, uint8_t *pkt, hdr = (BT_DATA << 4) | type; int plen; + if (!ch) + return; + do { plen = MIN(len, ch->remote_mtu - 1); pkt = ch->sdu_out(ch, plen + 1);
The current code bt_hid_send_data() did not check whether its first parameter *ch is NULL, which will cause a "Segmentation fault" when *ch is NULL as ch->remote_mtu will be directly referenced later in this function. E.g. when called by bt_hid_datain() and hid->interrupt is NULL with "qemu-system-x86_64 ... \ -bt device:keyboard,vlan=3". Thus add a judgement to avoid such error. Signed-off-by: Fei Li <fli@suse.com> --- hw/bt/hid.c | 3 +++ 1 file changed, 3 insertions(+)