File sdp-Fix-buffer-overflow.patch of Package bluez

Overview Repositories Revisions Requests Users Attributes Meta

File sdp-Fix-buffer-overflow.patch of Package bluez (Revision b80f8b12f9fd1fd5ae6f6166e3e22a1a)

Currently displaying revision b80f8b12f9fd1fd5ae6f6166e3e22a1a , Show latest

From 6c7243fb6ab90b7b855cead98c66394fedea135f Mon Sep 17 00:00:00 2001
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: Fri, 28 Sep 2018 16:08:32 +0300
Subject: [PATCH] sdp: Fix buffer overflow
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

sdp_append_buf shall check if there is enough space to store the data
before copying it.

An independent security researcher, Julian Rauchberger, has reported
this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure
program.
---
 lib/sdp.c | 6 ++++++
 1 file changed, 6 insertions(+)

Index: bluez-5.13/lib/sdp.c
===================================================================
--- bluez-5.13.orig/lib/sdp.c
+++ bluez-5.13/lib/sdp.c
@@ -2826,6 +2826,12 @@ void sdp_append_to_buf(sdp_buf_t *dst, u
 	SDPDBG("Append src size: %d", len);
 	SDPDBG("Append dst size: %d", dst->data_size);
 	SDPDBG("Dst buffer size: %d", dst->buf_size);
+
+	if (dst->data_size + len > dst->buf_size) {
+		SDPERR("Cannot append");
+		return;
+	}
+
 	if (dst->data_size == 0 && dtd == 0) {
 		/* create initial sequence */
 		*p = SDP_SEQ8;

Places

File sdp-Fix-buffer-overflow.patch of Package bluez (Revision b80f8b12f9fd1fd5ae6f6166e3e22a1a)

Places