[Pkg-bluetooth-maintainers] Bug#592124: bluez-hcidump: Segmentation fault during communication with a phone

[Németh Márton]

Cc: linux-bluetooth at vger.kernel.org

Márton Németh wrote:
> Program received signal SIGSEGV, Segmentation fault.
> 0x0805b19d in get_u8 (frm=0x806f028) at parser.h:163
> 163             return *u8_ptr;
> (gdb) bt
> #0  0x0805b19d in get_u8 (frm=0x806f028) at parser.h:163
> #1  0x0805b4cb in parse_headers (level=3, frm=0x806f028) at obex.c:196
> #2  0x0805b9ae in obex_dump (level=3, frm=0x806f028) at obex.c:307
> #3  0x08057d61 in uih_frame (level=2, frm=0xbffff4c0, head=0xbffff386) at rfcomm.c:278
> #4  0x08057e93 in rfcomm_dump (level=2, frm=0xbffff4c0) at rfcomm.c:325
> #5  0x08055224 in l2cap_parse (level=2, frm=0xbffff4c0) at l2cap.c:828
> #6  0x0805546b in l2cap_dump (level=1, frm=0xbffff4c0) at l2cap.c:904
> #7  0x080531d6 in acl_dump (level=1, frm=0xbffff4c0) at hci.c:3226
> #8  0x080534f9 in hci_dump (level=0, frm=0xbffff4c0) at hci.c:3302
> #9  0x080495f9 in parse (frm=0xbffff4c0) at ../parser/parser.h:248
> #10 0x08049dbd in process_frames (dev=0, sock=5, fd=-1, flags=0) at hcidump.c:352
> #11 0x0804b5ce in main (argc=0, argv=0xbffff668) at hcidump.c:1147
> (gdb)

The problem is reproducible with the attached test.dump file created
with "hcidump -w test.dump". When the test.dump file was recorded the
hcidump program was not crashed.

The "hcidump -r test.dump" crashes hcidump in the same way as shown above.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: test.dump
Type: application/octet-stream
Size: 4985 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-bluetooth-maintainers/attachments/20100807/8ca9ee78/attachment.obj>