From e09807c8ac635beddccb6aab8d26a88d9266ab6c Mon Sep 17 00:00:00 2001 From: Magdalena Kasenberg Date: Fri, 3 Jul 2026 17:50:56 +0200 Subject: [PATCH] apps/bttester: Fix null pointer dereference The 'cmd' is a pointer to struct btp_buf, not a flat buffer. The 'ev' field of the 'struct btp_buf' is initiated only once, in the avail_queue_init(void) function, so the 'struct btp_buf' instance cannot be completely zeroed out when restoring to 'avail_queue'. --- apps/bttester/src/bttester.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/apps/bttester/src/bttester.c b/apps/bttester/src/bttester.c index ad8a827d30..e814ed93a0 100644 --- a/apps/bttester/src/bttester.c +++ b/apps/bttester/src/bttester.c @@ -352,10 +352,10 @@ tester_rsp_full(uint8_t service, uint8_t opcode, const void *rsp, size_t len) cmd = delayed_cmd; delayed_cmd = NULL; - (void)memset(cmd, 0, sizeof(*cmd)); + (void)memset(cmd->data, 0, sizeof(cmd->data)); + (void)memset(cmd->rsp, 0, sizeof(cmd->rsp)); - os_eventq_put(&avail_queue, - CONTAINER_OF(cmd, struct btp_buf, data)->ev); + os_eventq_put(&avail_queue, cmd->ev); } void @@ -371,9 +371,10 @@ tester_rsp(uint8_t service, uint8_t opcode, uint8_t status) cmd = delayed_cmd; delayed_cmd = NULL; - (void)memset(cmd, 0, sizeof(*cmd)); - os_eventq_put(&avail_queue, - CONTAINER_OF(cmd, struct btp_buf, data)->ev); + (void)memset(cmd->data, 0, sizeof(cmd->data)); + (void)memset(cmd->rsp, 0, sizeof(cmd->rsp)); + + os_eventq_put(&avail_queue, cmd->ev); } uint16_t