diff options
| author | isherman <isherman@chromium.org> | 2015-03-11 13:36:06 -0700 |
|---|---|---|
| committer | Commit bot <commit-bot@chromium.org> | 2015-03-11 20:37:00 +0000 |
| commit | 847466627013483020c6683c303752b6fab97b97 (patch) | |
| tree | 1b410fc5dc0361be2f6e1e901dc8e017f428c52b /device | |
| parent | 1dfc595ffc753b6b1c99cca58e676e8b3e1bf6d8 (diff) | |
| download | chromium_src-847466627013483020c6683c303752b6fab97b97.zip chromium_src-847466627013483020c6683c303752b6fab97b97.tar.gz chromium_src-847466627013483020c6683c303752b6fab97b97.tar.bz2 | |
Fix a null-pointer dereference in ChromeOS Bluetooth code.
The code had undefined behavior, depending on what order the compiler chose to evaluate the arguments in. Specifically, the call to RegisterProfile() required evaluation of two arguments: |profile->object_path()| and |base::Bind(success_callback, base::Passed(&profile))|. If the latter was evaluated first, then |profile| would be null by the time that the prior was evaluated.
The crash stack is:
Program received signal SIGSEGV, Segmentation fault.
std::string::compare() const ()
StartsWithASCII()
dbus::IsValidObjectPath()
dbus::MessageWriter::AppendObjectPath()
chromeos::BluetoothProfileManagerClientImpl::RegisterProfile()
chromeos::BluetoothAdapterProfileChromeOS::Register()
chromeos::BluetoothAdapterChromeOS::UseProfile()
chromeos::BluetoothSocketChromeOS::RegisterProfile()
BUG=457978
TEST=(see bug, comment #14)
R=armansito@chromium.org, jamuraa@chromium.org
Review URL: https://codereview.chromium.org/997023002
Cr-Commit-Position: refs/heads/master@{#320139}
Diffstat (limited to 'device')
| -rw-r--r-- | device/bluetooth/bluetooth_adapter_profile_chromeos.cc | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/device/bluetooth/bluetooth_adapter_profile_chromeos.cc b/device/bluetooth/bluetooth_adapter_profile_chromeos.cc index f800304..207c55c4 100644 --- a/device/bluetooth/bluetooth_adapter_profile_chromeos.cc +++ b/device/bluetooth/bluetooth_adapter_profile_chromeos.cc @@ -28,8 +28,9 @@ void BluetoothAdapterProfileChromeOS::Register( new BluetoothAdapterProfileChromeOS(uuid)); VLOG(1) << "Registering profile: " << profile->object_path().value(); + const dbus::ObjectPath& object_path = profile->object_path(); DBusThreadManager::Get()->GetBluetoothProfileManagerClient()->RegisterProfile( - profile->object_path(), + object_path, uuid.canonical_value(), options, base::Bind(success_callback, base::Passed(&profile)), |