Samsung D600 (sdp, service discovery deadlocks)

Hi Marcel,

We experienced some deadlock in the bluez library for Samsund-D600 phone during service discovery. This is due to incorrect SDP record set returned on service inquiry request. The response from the SDP server contains service records + some rubbish at the end. So when it tries to parse it, sdp_extract_pdu() returns 0 recsize and locks the while() loop.
Samsung is informed, but I do not know if they will come up with something (have no idea who provides the stack for them, they have a Broadcom chip in there)

The patch is attached.

Regards,
Victor.

P.S. I do not have the phone with me now, otherwise I would send in hcidump output. It reports errors when trying to parse at the end of response.

Index: src/sdp.c
===================================================================
RCS file: /cvsroot/bluez/libs/src/sdp.c,v
retrieving revision 1.30

diff -u -r1.30 sdp.c
@@ -3115,6 +3115,10 @@
 					status = -1;
 					goto end;
 				}
+				if (!recsize) {
+					sdp_record_free(rec);
+					break;
+				}
 				scanned += recsize;
 				pdata += recsize;
 

Hi Victor,

the patch is in the CVS now. Thanks.

Don't expect anything.

I like to have these phones at home for further testing, but getting all the bad phones is quite an expensive hobby. The donations are not enough to buy them.

Regards

Marcel

-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files for problems? Stop! Download the new AJAX search engine that makes searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
Bluez-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bluez-devel