Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bluetooth: host: missing NULL check in bt_le_create_conn_cancel #85301

Open
JordanYates opened this issue Feb 6, 2025 · 0 comments
Open

Bluetooth: host: missing NULL check in bt_le_create_conn_cancel #85301

JordanYates opened this issue Feb 6, 2025 · 0 comments
Assignees
Labels
area: Bluetooth Host Bluetooth Host (excluding BR/EDR) area: Bluetooth bug The issue is a bug, or the PR is fixing a bug

Comments

@JordanYates
Copy link
Collaborator

Describe the bug

Due to a missing NULL check in bt_le_create_conn_cancel a NULL pointer can be provided to bt_hci_cmd_state_set_init, causing a fault.

buf = bt_hci_cmd_create(BT_HCI_OP_LE_CREATE_CONN_CANCEL, 0);
bt_hci_cmd_state_set_init(buf, &state, bt_dev.flags,

Expected behavior

Return value of bt_hci_cmd_create should be checked before use.

Impact

Program faults

Environment (please complete the following information):

  • Zephyr v3.7.0
  • Zephyr v4.0.0
@JordanYates JordanYates added the bug The issue is a bug, or the PR is fixing a bug label Feb 6, 2025
@henrikbrixandersen henrikbrixandersen added area: Bluetooth area: Bluetooth Host Bluetooth Host (excluding BR/EDR) labels Feb 7, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area: Bluetooth Host Bluetooth Host (excluding BR/EDR) area: Bluetooth bug The issue is a bug, or the PR is fixing a bug
Projects
None yet
Development

No branches or pull requests

4 participants