Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE:Leap:15.2
bluez
0011-btmon-fix-segfault-caused-by-integer-under...
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File 0011-btmon-fix-segfault-caused-by-integer-underflow.patch of Package bluez
From 800257a5aae104ba73c5d299cd350643610998b0 Mon Sep 17 00:00:00 2001 From: Matias Karhumaa <matias.karhumaa@gmail.com> Date: Tue, 16 Oct 2018 23:24:41 +0300 Subject: [PATCH 11/13] btmon: fix segfault caused by integer underflow Fix segfault caused by integer underflow in decode_data_element function of monitor/sdp.c. Fix is to check that elemlen is not bigger than size before subtracting elemlen from size. Also search_bytes + attr_bytes should not be bigger than frame->size. This bug can be triggered locally reading malformed btmon capture file and also over the air by sending specifically crafted SDP Search Attribute response to device running btmon. This bug was found by fuzzing btmon with AFL. --- monitor/sdp.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/monitor/sdp.c b/monitor/sdp.c index df5ccdb71..13a8807c7 100644 --- a/monitor/sdp.c +++ b/monitor/sdp.c @@ -309,6 +309,11 @@ static void decode_data_elements(uint32_t position, uint8_t indent, break; } + if (elemlen > size) { + print_text(COLOR_ERROR, "invalid data element size"); + return; + } + data += elemlen; size -= elemlen; @@ -655,6 +660,11 @@ static void search_attr_req(const struct l2cap_frame *frame, frame->size - search_bytes - 2); print_field("Attribute list: [len %d]", attr_bytes); + if (search_bytes + attr_bytes > frame->size) { + print_text(COLOR_ERROR, "invalid attribute list length"); + return; + } + decode_data_elements(0, 2, frame->data + search_bytes + 2, attr_bytes, NULL); -- 2.19.1
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor