Skip to content

RDKEMW-12176: btrCore_PopulateListOfPairedCrash l #82

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
PreethiALPI wants to merge 5 commits into
base: develop
Choose a base branch
from
+78 −1
Open

RDKEMW-12176: btrCore_PopulateListOfPairedCrash l #82

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
92f5d53
RDKEMW-12176: btrCore_PopulateListOfPairedCrash latest
ppalan289 Aug 13, 2026
0de0d5f
RDKEMW-12176: btrCore_PopulateListOfPairedCrash l
ppalan289 Aug 13, 2026
10e9a84
RDKEMW-12176: btrCore_PopulateListOfPairedCrash l
ppalan289 Aug 13, 2026
aaf1688
RDKEMW-12176: btrCore_PopulateListOfPairedCrash l
ppalan289 Aug 13, 2026
f05c279
RDKEMW-12176: btrCore_PopulateListOfPairedCrash l
ppalan289 Aug 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
79 changes: 78 additions & 1 deletion src/btrCore.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,6 +74,9 @@ int b_rdk_logger_enabled = 0;
#define BTRCORE_GOOGLE_OUI_LENGTH 8
#define BTCORE_DEFAULT_CONTROLLER_NAME "Game Controller"

/* Prevent UAF during teardown */
static gint gIsBtrCoreTerminating = 0;

static char * BTRCORE_REMOTE_OUI_VALUES[] = {
"20:44:41", //LC103
"E8:0F:C8", //EC302
Expand Down Expand Up @@ -1482,10 +1485,21 @@ btrCore_PopulateListOfPairedDevices (
stBTPairedDeviceInfo* pstBTPairedDeviceInfo = NULL;
stBTRCoreBTDevice knownDevicesArr[BTRCORE_MAX_NUM_BT_DEVICES];

if (!apsthBTRCore) {
BTRCORELOG_WARN("apsthBTRCore is null\n");
return enBTRCoreNotInitialized;
}

if ((pstBTPairedDeviceInfo = g_malloc0(sizeof(stBTPairedDeviceInfo))) == NULL)
/* Prevent UAF during teardown is in progress */
if(g_atomic_int_get(&gIsBtrCoreTerminating)) {
BTRCORELOG_WARN("btrCore: Ignoring PopulateListOfPairedDevices during termination\n");
return enBTRCoreFailure;
}

if ((pstBTPairedDeviceInfo = g_malloc0(sizeof(stBTPairedDeviceInfo))) == NULL) {
BTRCORELOG_WARN("btrCore: g_malloc0 failed\n");
return enBTRCoreFailure;
}

pstBTPairedDeviceInfo->numberOfDevices = 0;
for (i_idx = 0; i_idx < BT_MAX_NUM_DEVICE; i_idx++) {
Expand Down Expand Up @@ -1681,6 +1695,17 @@ btrCore_GetDeviceInfo (
unsigned int ui32NumOfDevices = 0;
unsigned int ui32LoopIdx = 0;

if (!apsthBTRCore) {
BTRCORELOG_WARN("apsthBTRCore is null\n");
return enBTRCoreNotInitialized;
}

/* Prevent UAF during teardown is in progress */
if(g_atomic_int_get(&gIsBtrCoreTerminating)) {
BTRCORELOG_WARN("btrCore: Ignoring btrCore_GetDeviceInfo during termination\n");
return enBTRCoreFailure;
}

if (!apsthBTRCore->numOfPairedDevices) {
BTRCORELOG_INFO ("Possibly the list is not populated; like booted and connecting\n");
btrCore_PopulateListOfPairedDevices(apsthBTRCore, apsthBTRCore->curAdapterPath); /* Keep the list upto date */
Expand Down Expand Up @@ -1849,6 +1874,17 @@ btrCore_GetDeviceInfoKnown (
unsigned int ui32NumOfDevices = 0;
unsigned int ui32LoopIdx = 0;

if (!apsthBTRCore) {
BTRCORELOG_WARN("apsthBTRCore is null\n");
return enBTRCoreNotInitialized;
}

/* Prevent UAF during teardown is in progress */
if(g_atomic_int_get(&gIsBtrCoreTerminating)) {
BTRCORELOG_WARN("btrCore: Ignoring btrCore_GetDeviceInfoKnown during termination\n");
return enBTRCoreFailure;
}

if (!apsthBTRCore->numOfPairedDevices) {
BTRCORELOG_INFO ("Possibly the list is not populated; like booted and connecting\n");
btrCore_PopulateListOfPairedDevices(apsthBTRCore, apsthBTRCore->curAdapterPath); /* Keep the list upto date */
Expand Down Expand Up @@ -3524,6 +3560,8 @@ BTRCore_Init (
}
MEMSET_S(pstlhBTRCore, sizeof(stBTRCoreHdl), 0, sizeof(stBTRCoreHdl));

/* Reset the variable indicating btrCore is initialized, not terminating */
g_atomic_int_set(&gIsBtrCoreTerminating, 0);

pstlhBTRCore->connHdl = BtrCore_BTInitGetConnection();
if (!pstlhBTRCore->connHdl) {
Expand Down Expand Up @@ -3686,6 +3724,9 @@ BTRCore_DeInit (

pstlhBTRCore = (stBTRCoreHdl*)hBTRCore;

/* Set Terminating variable when deinit is in progress. */
g_atomic_int_set(&gIsBtrCoreTerminating, 1);

BTRCORELOG_INFO ("hBTRCore = %8p\n", hBTRCore);

if (pstlhBTRCore->hidNameWaitInitialized) {
Expand Down Expand Up @@ -4639,6 +4680,12 @@ BTRCore_PairDevice (
return enBTRCoreNotInitialized;
}

/* Prevent UAF during teardown is in progress */
if(g_atomic_int_get(&gIsBtrCoreTerminating)) {
BTRCORELOG_WARN("btrCore: Ignoring accessing stBTRCoreHdl_p during termination\n");
return enBTRCoreFailure;
}

pstlhBTRCore = (stBTRCoreHdl*)hBTRCore;

if (aBTRCoreDevId < BTRCORE_MAX_NUM_BT_DISCOVERED_DEVICES) {
Expand Down Expand Up @@ -4751,6 +4798,12 @@ BTRCore_UnPairDevice (
return enBTRCoreNotInitialized;
}

/* Prevent UAF during teardown is in progress */
if(g_atomic_int_get(&gIsBtrCoreTerminating)) {
BTRCORELOG_WARN("btrCore: Ignoring accessing hBTRCore during termination\n");
return enBTRCoreFailure;
}

pstlhBTRCore = (stBTRCoreHdl*)hBTRCore;

if ((lenBTRCoreRet = btrCore_GetDeviceInfoKnown(pstlhBTRCore, aBTRCoreDevId, aenBTRCoreDevType,
Expand Down Expand Up @@ -4820,6 +4873,12 @@ BTRCore_GetListOfPairedDevices (
return enBTRCoreInvalidArg;
}

/* Prevent UAF during teardown is in progress */
if(g_atomic_int_get(&gIsBtrCoreTerminating)) {
BTRCORELOG_WARN("btrCore: Ignoring hBTRCore access during termination\n");
return enBTRCoreFailure;
}

pstlhBTRCore = (stBTRCoreHdl*)hBTRCore;

if (btrCore_PopulateListOfPairedDevices(pstlhBTRCore, pstlhBTRCore->curAdapterPath) == enBTRCoreSuccess) {
Expand Down Expand Up @@ -5028,6 +5087,12 @@ BTRCore_IsDeviceConnectable (
return enBTRCoreNotInitialized;
}

/* Prevent UAF during teardown is in progress */
if(g_atomic_int_get(&gIsBtrCoreTerminating)) {
BTRCORELOG_WARN("btrCore: ignoring accessing hBTRCore while termination\n");
return enBTRCoreFailure;
}

pstlhBTRCore = (stBTRCoreHdl*)hBTRCore;

if (!pstlhBTRCore->numOfPairedDevices) {
Expand Down Expand Up @@ -5400,6 +5465,12 @@ enBTRCoreRet BTRCore_refreshLEActionListForGamepads(tBTRCoreHandle hBTRCore)
return enBTRCoreNotInitialized;
}

/* Prevent UAF during teardown is in progress */
if(g_atomic_int_get(&gIsBtrCoreTerminating)) {
BTRCORELOG_WARN("btrCore: Ignoring BTRCore_refreshLEActionListForGamepads during termination\n");
return enBTRCoreFailure;
}

if (btrCore_PopulateListOfPairedDevices(pstlhBTRCore, pstlhBTRCore->curAdapterPath) == enBTRCoreSuccess) {
for (i32DevIdx = 0; i32DevIdx < pstlhBTRCore->numOfPairedDevices; i32DevIdx++) {
//only refresh action list for LE gamepads
Expand Down Expand Up @@ -5464,6 +5535,12 @@ enBTRCoreRet BTRCore_clearLEActionListForGamepads(tBTRCoreHandle hBTRCore)
return enBTRCoreNotInitialized;
}

/* Prevent UAF during teardown is in progress */
if(g_atomic_int_get(&gIsBtrCoreTerminating)) {
BTRCORELOG_WARN("btrCore: Ignoring BTRCore_clearLEActionListForGamepads during termination\n");
return enBTRCoreFailure;
}

if (btrCore_PopulateListOfPairedDevices(pstlhBTRCore, pstlhBTRCore->curAdapterPath) == enBTRCoreSuccess) {
for (i32DevIdx = 0; i32DevIdx < pstlhBTRCore->numOfPairedDevices; i32DevIdx++) {
//only refresh action list for LE gamepads
Expand Down
Loading