Skip to content

Commit 2fbb10c

Browse files
sjanccfriedt
authored andcommitted
tests: bluetooth: tester: Fix NULL pointer dereference in error path
bt_conn_unref() requires valid conn pointer but could be called with NULL in case valid connection was not found in disconnect_eatt_chans(). Fixes #39851 Signed-off-by: Szymon Janc <[email protected]>
1 parent 2f9ae20 commit 2fbb10c

File tree

1 file changed

+4
-4
lines changed

1 file changed

+4
-4
lines changed

tests/bluetooth/tester/src/l2cap.c

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -336,22 +336,22 @@ void disconnect_eatt_chans(uint8_t *data, uint16_t len)
336336
if (!conn) {
337337
LOG_ERR("Unknown connection");
338338
status = BTP_STATUS_FAILED;
339-
goto rsp;
339+
goto failed;
340340
}
341341

342342
for (int i = 0; i < cmd->count; i++) {
343343
err = bt_eatt_disconnect_one(conn);
344344
if (err) {
345345
status = BTP_STATUS_FAILED;
346-
goto rsp;
346+
goto unref;
347347
}
348348
}
349349

350350
status = BTP_STATUS_SUCCESS;
351351

352-
rsp:
352+
unref:
353353
bt_conn_unref(conn);
354-
354+
failed:
355355
tester_rsp(BTP_SERVICE_ID_L2CAP, L2CAP_DISCONNECT_EATT_CHANS,
356356
CONTROLLER_INDEX, status);
357357
}

0 commit comments

Comments
 (0)