File 0011-btmon-fix-segfault-caused-by-integer-under... of Package bluez.13599

Overview Repositories Revisions Requests Users Attributes Meta

File 0011-btmon-fix-segfault-caused-by-integer-underflow.patch of Package bluez.13599

From 800257a5aae104ba73c5d299cd350643610998b0 Mon Sep 17 00:00:00 2001
From: Matias Karhumaa <matias.karhumaa@gmail.com>
Date: Tue, 16 Oct 2018 23:24:41 +0300
Subject: [PATCH 11/13] btmon: fix segfault caused by integer underflow

Fix segfault caused by integer underflow in decode_data_element function
of monitor/sdp.c.

Fix is to check that elemlen is not bigger than size before subtracting
elemlen from size. Also search_bytes + attr_bytes should not be bigger
than frame->size.

This bug can be triggered locally reading malformed btmon capture file
and also over the air by sending specifically crafted SDP Search
Attribute response to device running btmon.

This bug was found by fuzzing btmon with AFL.
---
 monitor/sdp.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/monitor/sdp.c b/monitor/sdp.c
index df5ccdb71..13a8807c7 100644
--- a/monitor/sdp.c
+++ b/monitor/sdp.c
@@ -309,6 +309,11 @@ static void decode_data_elements(uint32_t position, uint8_t indent,
 		break;
 	}
 
+	if (elemlen > size) {
+		print_text(COLOR_ERROR, "invalid data element size");
+		return;
+	}
+
 	data += elemlen;
 	size -= elemlen;
 
@@ -655,6 +660,11 @@ static void search_attr_req(const struct l2cap_frame *frame,
 				frame->size - search_bytes - 2);
 	print_field("Attribute list: [len %d]", attr_bytes);
 
+	if (search_bytes + attr_bytes > frame->size) {
+		print_text(COLOR_ERROR, "invalid attribute list length");
+		return;
+	}
+
 	decode_data_elements(0, 2, frame->data + search_bytes + 2,
 						attr_bytes, NULL);
 
-- 
2.19.1

Places

File 0011-btmon-fix-segfault-caused-by-integer-underflow.patch of Package bluez.13599

Places