File 0004-btmon-fix-segfault-caused-by-buffer-over-r... of Package bluez.5742

Overview Repositories Revisions Requests Users Attributes Meta

File 0004-btmon-fix-segfault-caused-by-buffer-over-read.patch of Package bluez.5742

From 3ebf246be6e9fbfe8262473f60f42ce08892c0f9 Mon Sep 17 00:00:00 2001
From: Matias Karhumaa <matias.karhumaa@gmail.com>
Date: Tue, 16 Oct 2018 23:25:08 +0300
Subject: [PATCH 12/13] btmon: fix segfault caused by buffer over-read

Fix segfault caused by buffer over-read in service_rsp function of
monitor/sdp.c.

This bug can be triggered locally reading malformed btmon capture file
and also over the air by sending specifically crafted SDP Search
Attribute response to device running btmon.

Bug was found by fuzzing btmon with AFL.
---
 monitor/sdp.c | 4 ++++
 1 file changed, 4 insertions(+)

Index: bluez-5.13/monitor/sdp.c
===================================================================
--- bluez-5.13.orig/monitor/sdp.c
+++ bluez-5.13/monitor/sdp.c
@@ -584,6 +584,10 @@ static void service_rsp(const struct l2c
 	}
 
 	count = bt_get_be16(frame->data + 2);
+	if (count * 4 > frame->size) {
+		print_text(COLOR_ERROR, "invalid record count");
+		return;
+	}
 
 	print_field("Total record count: %d", bt_get_be16(frame->data));
 	print_field("Current record count: %d", count);

Places

File 0004-btmon-fix-segfault-caused-by-buffer-over-read.patch of Package bluez.5742

Places