diff --git a/src/btrCore.c b/src/btrCore.c index d1d5967..b1b1649 100644 --- a/src/btrCore.c +++ b/src/btrCore.c @@ -74,6 +74,9 @@ int b_rdk_logger_enabled = 0; #define BTRCORE_GOOGLE_OUI_LENGTH 8 #define BTCORE_DEFAULT_CONTROLLER_NAME "Game Controller" +/* Prevent UAF during teardown */ +static gint gIsBtrCoreTerminating = 0; + static char * BTRCORE_REMOTE_OUI_VALUES[] = { "20:44:41", //LC103 "E8:0F:C8", //EC302 @@ -1482,10 +1485,21 @@ btrCore_PopulateListOfPairedDevices ( stBTPairedDeviceInfo* pstBTPairedDeviceInfo = NULL; stBTRCoreBTDevice knownDevicesArr[BTRCORE_MAX_NUM_BT_DEVICES]; + if (!apsthBTRCore) { + BTRCORELOG_WARN("apsthBTRCore is null\n"); + return enBTRCoreNotInitialized; + } - if ((pstBTPairedDeviceInfo = g_malloc0(sizeof(stBTPairedDeviceInfo))) == NULL) + /* Prevent UAF during teardown is in progress */ + if(g_atomic_int_get(&gIsBtrCoreTerminating)) { + BTRCORELOG_WARN("btrCore: Ignoring PopulateListOfPairedDevices during termination\n"); return enBTRCoreFailure; + } + if ((pstBTPairedDeviceInfo = g_malloc0(sizeof(stBTPairedDeviceInfo))) == NULL) { + BTRCORELOG_WARN("btrCore: g_malloc0 failed\n"); + return enBTRCoreFailure; + } pstBTPairedDeviceInfo->numberOfDevices = 0; for (i_idx = 0; i_idx < BT_MAX_NUM_DEVICE; i_idx++) { @@ -1681,6 +1695,17 @@ btrCore_GetDeviceInfo ( unsigned int ui32NumOfDevices = 0; unsigned int ui32LoopIdx = 0; + if (!apsthBTRCore) { + BTRCORELOG_WARN("apsthBTRCore is null\n"); + return enBTRCoreNotInitialized; + } + + /* Prevent UAF during teardown is in progress */ + if(g_atomic_int_get(&gIsBtrCoreTerminating)) { + BTRCORELOG_WARN("btrCore: Ignoring btrCore_GetDeviceInfo during termination\n"); + return enBTRCoreFailure; + } + if (!apsthBTRCore->numOfPairedDevices) { BTRCORELOG_INFO ("Possibly the list is not populated; like booted and connecting\n"); btrCore_PopulateListOfPairedDevices(apsthBTRCore, apsthBTRCore->curAdapterPath); /* Keep the list upto date */ @@ -1849,6 +1874,17 @@ btrCore_GetDeviceInfoKnown ( unsigned int ui32NumOfDevices = 0; unsigned int ui32LoopIdx = 0; + if (!apsthBTRCore) { + BTRCORELOG_WARN("apsthBTRCore is null\n"); + return enBTRCoreNotInitialized; + } + + /* Prevent UAF during teardown is in progress */ + if(g_atomic_int_get(&gIsBtrCoreTerminating)) { + BTRCORELOG_WARN("btrCore: Ignoring btrCore_GetDeviceInfoKnown during termination\n"); + return enBTRCoreFailure; + } + if (!apsthBTRCore->numOfPairedDevices) { BTRCORELOG_INFO ("Possibly the list is not populated; like booted and connecting\n"); btrCore_PopulateListOfPairedDevices(apsthBTRCore, apsthBTRCore->curAdapterPath); /* Keep the list upto date */ @@ -3524,6 +3560,8 @@ BTRCore_Init ( } MEMSET_S(pstlhBTRCore, sizeof(stBTRCoreHdl), 0, sizeof(stBTRCoreHdl)); + /* Reset the variable indicating btrCore is initialized, not terminating */ + g_atomic_int_set(&gIsBtrCoreTerminating, 0); pstlhBTRCore->connHdl = BtrCore_BTInitGetConnection(); if (!pstlhBTRCore->connHdl) { @@ -3686,6 +3724,9 @@ BTRCore_DeInit ( pstlhBTRCore = (stBTRCoreHdl*)hBTRCore; + /* Set Terminating variable when deinit is in progress. */ + g_atomic_int_set(&gIsBtrCoreTerminating, 1); + BTRCORELOG_INFO ("hBTRCore = %8p\n", hBTRCore); if (pstlhBTRCore->hidNameWaitInitialized) { @@ -4639,6 +4680,12 @@ BTRCore_PairDevice ( return enBTRCoreNotInitialized; } + /* Prevent UAF during teardown is in progress */ + if(g_atomic_int_get(&gIsBtrCoreTerminating)) { + BTRCORELOG_WARN("btrCore: Ignoring accessing stBTRCoreHdl_p during termination\n"); + return enBTRCoreFailure; + } + pstlhBTRCore = (stBTRCoreHdl*)hBTRCore; if (aBTRCoreDevId < BTRCORE_MAX_NUM_BT_DISCOVERED_DEVICES) { @@ -4751,6 +4798,12 @@ BTRCore_UnPairDevice ( return enBTRCoreNotInitialized; } + /* Prevent UAF during teardown is in progress */ + if(g_atomic_int_get(&gIsBtrCoreTerminating)) { + BTRCORELOG_WARN("btrCore: Ignoring accessing hBTRCore during termination\n"); + return enBTRCoreFailure; + } + pstlhBTRCore = (stBTRCoreHdl*)hBTRCore; if ((lenBTRCoreRet = btrCore_GetDeviceInfoKnown(pstlhBTRCore, aBTRCoreDevId, aenBTRCoreDevType, @@ -4820,6 +4873,12 @@ BTRCore_GetListOfPairedDevices ( return enBTRCoreInvalidArg; } + /* Prevent UAF during teardown is in progress */ + if(g_atomic_int_get(&gIsBtrCoreTerminating)) { + BTRCORELOG_WARN("btrCore: Ignoring hBTRCore access during termination\n"); + return enBTRCoreFailure; + } + pstlhBTRCore = (stBTRCoreHdl*)hBTRCore; if (btrCore_PopulateListOfPairedDevices(pstlhBTRCore, pstlhBTRCore->curAdapterPath) == enBTRCoreSuccess) { @@ -5028,6 +5087,12 @@ BTRCore_IsDeviceConnectable ( return enBTRCoreNotInitialized; } + /* Prevent UAF during teardown is in progress */ + if(g_atomic_int_get(&gIsBtrCoreTerminating)) { + BTRCORELOG_WARN("btrCore: ignoring accessing hBTRCore while termination\n"); + return enBTRCoreFailure; + } + pstlhBTRCore = (stBTRCoreHdl*)hBTRCore; if (!pstlhBTRCore->numOfPairedDevices) { @@ -5400,6 +5465,12 @@ enBTRCoreRet BTRCore_refreshLEActionListForGamepads(tBTRCoreHandle hBTRCore) return enBTRCoreNotInitialized; } + /* Prevent UAF during teardown is in progress */ + if(g_atomic_int_get(&gIsBtrCoreTerminating)) { + BTRCORELOG_WARN("btrCore: Ignoring BTRCore_refreshLEActionListForGamepads during termination\n"); + return enBTRCoreFailure; + } + if (btrCore_PopulateListOfPairedDevices(pstlhBTRCore, pstlhBTRCore->curAdapterPath) == enBTRCoreSuccess) { for (i32DevIdx = 0; i32DevIdx < pstlhBTRCore->numOfPairedDevices; i32DevIdx++) { //only refresh action list for LE gamepads @@ -5464,6 +5535,12 @@ enBTRCoreRet BTRCore_clearLEActionListForGamepads(tBTRCoreHandle hBTRCore) return enBTRCoreNotInitialized; } + /* Prevent UAF during teardown is in progress */ + if(g_atomic_int_get(&gIsBtrCoreTerminating)) { + BTRCORELOG_WARN("btrCore: Ignoring BTRCore_clearLEActionListForGamepads during termination\n"); + return enBTRCoreFailure; + } + if (btrCore_PopulateListOfPairedDevices(pstlhBTRCore, pstlhBTRCore->curAdapterPath) == enBTRCoreSuccess) { for (i32DevIdx = 0; i32DevIdx < pstlhBTRCore->numOfPairedDevices; i32DevIdx++) { //only refresh action list for LE gamepads