File hcidump-Fix-memory-leak-with-malformed-packet.p... of Package bluez

Overview Repositories Revisions Requests Users Attributes Meta

File hcidump-Fix-memory-leak-with-malformed-packet.patch of Package bluez (Revision 0e610dadafc3a4b470ffacdbc9ed9362)

Currently displaying revision 0e610dadafc3a4b470ffacdbc9ed9362 , Show latest

From 98bee47cca1b8a6b17bb0178f951fe7902abc2f0 Mon Sep 17 00:00:00 2001
From: "Cho, Yu-Chen" <acho@suse.com>
Date: Wed, 24 Apr 2019 16:10:56 +0800
Subject: [PATCH BlueZ] tool/hcidump: Fix memory leak with malformed packet

Do not allow to read more than allocated data buffer size.
Because of the buffer is malloc(HCI_MAX_FRAME_SIZE),
so there is heap buffer overflow if read the size more than
HCI_MAX_FRAME_SIZE and fd size is larger than HCI_MAX_FRAME_SIZE.
---
 tools/hcidump.c | 9 +++++++++
 1 file changed, 9 insertions(+)

Index: bluez-5.54/tools/hcidump.c
===================================================================
--- bluez-5.54.orig/tools/hcidump.c
+++ bluez-5.54/tools/hcidump.c
@@ -105,6 +105,15 @@ struct pktlog_hdr {
 static inline int read_n(int fd, char *buf, int len)
 {
 	int t = 0, w;
+	off_t fsize, currentpos, startpos;
+
+	currentpos = lseek(fd, 0, SEEK_CUR);
+	fsize = lseek(fd, 0, SEEK_END);
+	lseek(fd, currentpos, SEEK_SET);
+	fsize -= currentpos;
+
+	if (fsize > HCI_MAX_FRAME_SIZE && len > HCI_MAX_FRAME_SIZE)
+		return -1;
 
 	while (len > 0) {
 		if ((w = read(fd, buf, len)) < 0) {

Places

File hcidump-Fix-memory-leak-with-malformed-packet.patch of Package bluez (Revision 0e610dadafc3a4b470ffacdbc9ed9362)

Places