bluetooth: Fix null pointer dereference before null check issues.

bug: v/81520

In `spp_find_connection_by_sdp_param` and `spp_connect_with_uuid`, the pointer `spp_conn` was dereferenced before the NULL check. This patch ensures the pointer is validated before access to avoid potential crashes.

Signed-off-by: v-yichenxi <[email protected]>

Author: EListenX

service/stacks/zephyr/sal_spp_interface.c

@@ -219,7 +219,7 @@ static sal_spp_connection_t* spp_find_connection_by_sdp_param(struct bt_conn* co
 
         spp_conn = bt_list_node(node);
         spp_client = spp_conn->spp_client;
-        if ((spp_conn && (spp_conn->conn == conn)) && (spp_client && (&spp_client->sdp_discover == param))) {
+        if ((spp_conn->conn == conn) && (spp_client && (&spp_client->sdp_discover == param))) {
             return spp_conn;
         }
     }
@@ -771,7 +771,7 @@ static void sdp_disconnected_cb(struct bt_conn* conn, const struct bt_sdp_discov
 
 static bt_status_t spp_connect_with_uuid(sal_spp_connection_t* spp_conn, bt_uuid_t* uuid)
 {
-    sal_spp_client_t* spp_client = spp_conn->spp_client;
+    sal_spp_client_t* spp_client;
     int err;
     bt_uuid_t uuid_128;
 
@@ -780,6 +780,12 @@ static bt_status_t spp_connect_with_uuid(sal_spp_connection_t* spp_conn, bt_uuid
         return BT_STATUS_PARM_INVALID;
     }
 
+    spp_client = spp_conn->spp_client;
+    if (!spp_client) {
+        BT_LOGE("SPP client not found for conn");
+        return BT_STATUS_PARM_INVALID;
+    }
+
     sys_memcpy_swap(uuid_128.val.u128, uuid->val.u128, sizeof(uuid->val.u128));
 
     err = bt_uuid_create((struct bt_uuid*)&spp_client->uuid_128, uuid_128.val.u128, BT_UUID_SIZE_128);