(mynewt-nimble) branch master updated: apps/bttester: Fix null pointer dereference

[janc]

This is an automated email from the ASF dual-hosted git repository.

sjanc pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/mynewt-nimble.git


The following commit(s) were added to refs/heads/master by this push:
     new 7af6db17d apps/bttester: Fix null pointer dereference
7af6db17d is described below

commit 7af6db17dfc82a03f24e7ba08e097139588ccd8d
Author: Magdalena Kasenberg <magdalena.kasenb...@codecoup.pl>
AuthorDate: Fri Jul 3 17:50:56 2026 +0200

    apps/bttester: Fix null pointer dereference
    
    The 'cmd' is a pointer to struct btp_buf, not a flat buffer.
    The 'ev' field of the 'struct btp_buf' is initiated only once, in the
    avail_queue_init(void) function, so the 'struct btp_buf' instance
    cannot be completely zeroed out when restoring to 'avail_queue'.
---
 apps/bttester/src/bttester.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/apps/bttester/src/bttester.c b/apps/bttester/src/bttester.c
index ad8a827d3..e814ed93a 100644
--- a/apps/bttester/src/bttester.c
+++ b/apps/bttester/src/bttester.c
@@ -352,10 +352,10 @@ tester_rsp_full(uint8_t service, uint8_t opcode, const 
void *rsp, size_t len)
     cmd = delayed_cmd;
     delayed_cmd = NULL;
 
-    (void)memset(cmd, 0, sizeof(*cmd));
+    (void)memset(cmd->data, 0, sizeof(cmd->data));
+    (void)memset(cmd->rsp, 0, sizeof(cmd->rsp));
 
-    os_eventq_put(&avail_queue,
-                  CONTAINER_OF(cmd, struct btp_buf, data)->ev);
+    os_eventq_put(&avail_queue, cmd->ev);
 }
 
 void
@@ -371,9 +371,10 @@ tester_rsp(uint8_t service, uint8_t opcode, uint8_t status)
     cmd = delayed_cmd;
     delayed_cmd = NULL;
 
-    (void)memset(cmd, 0, sizeof(*cmd));
-    os_eventq_put(&avail_queue,
-                  CONTAINER_OF(cmd, struct btp_buf, data)->ev);
+    (void)memset(cmd->data, 0, sizeof(cmd->data));
+    (void)memset(cmd->rsp, 0, sizeof(cmd->rsp));
+
+    os_eventq_put(&avail_queue, cmd->ev);
 }
 
 uint16_t