File 0003-btmon-fix-segfault-caused-by-integer-under... of Package bluez.12905

Overview Repositories Revisions Requests Users Attributes Meta

File 0003-btmon-fix-segfault-caused-by-integer-underflow.patch of Package bluez.12905

From 800257a5aae104ba73c5d299cd350643610998b0 Mon Sep 17 00:00:00 2001
From: Matias Karhumaa <matias.karhumaa@gmail.com>
Date: Tue, 16 Oct 2018 23:24:41 +0300
Subject: [PATCH 11/13] btmon: fix segfault caused by integer underflow

Fix segfault caused by integer underflow in decode_data_element function
of monitor/sdp.c.

Fix is to check that elemlen is not bigger than size before subtracting
elemlen from size. Also search_bytes + attr_bytes should not be bigger
than frame->size.

This bug can be triggered locally reading malformed btmon capture file
and also over the air by sending specifically crafted SDP Search
Attribute response to device running btmon.

This bug was found by fuzzing btmon with AFL.
---
 monitor/sdp.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

Index: bluez-5.13/monitor/sdp.c
===================================================================
--- bluez-5.13.orig/monitor/sdp.c
+++ bluez-5.13/monitor/sdp.c
@@ -308,6 +308,11 @@ static void decode_data_elements(uint32_
 		break;
 	}
 
+	if (elemlen > size) {
+		print_text(COLOR_ERROR, "invalid data element size");
+		return;
+	}
+
 	data += elemlen;
 	size -= elemlen;
 
@@ -654,6 +659,11 @@ static void search_attr_req(const struct
 				frame->size - search_bytes - 2);
 	print_field("Attribute list: [len %d]", attr_bytes);
 
+	if (search_bytes + attr_bytes > frame->size) {
+		print_text(COLOR_ERROR, "invalid attribute list length");
+		return;
+	}
+
 	decode_data_elements(0, 2, frame->data + search_bytes + 2,
 						attr_bytes, NULL);

Places

File 0003-btmon-fix-segfault-caused-by-integer-underflow.patch of Package bluez.12905

Places