File 0012-btmon-fix-segfault-caused-by-buffer-over-r... of Package bluez

Overview Repositories Revisions Requests Users Attributes Meta

File 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch of Package bluez (Revision fa2aaf081c7bbb904715d6bc039bb688)

Currently displaying revision fa2aaf081c7bbb904715d6bc039bb688 , Show latest

From 3ebf246be6e9fbfe8262473f60f42ce08892c0f9 Mon Sep 17 00:00:00 2001
From: Matias Karhumaa <matias.karhumaa@gmail.com>
Date: Tue, 16 Oct 2018 23:25:08 +0300
Subject: [PATCH 12/13] btmon: fix segfault caused by buffer over-read

Fix segfault caused by buffer over-read in service_rsp function of
monitor/sdp.c.

This bug can be triggered locally reading malformed btmon capture file
and also over the air by sending specifically crafted SDP Search
Attribute response to device running btmon.

Bug was found by fuzzing btmon with AFL.
---
 monitor/sdp.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/monitor/sdp.c b/monitor/sdp.c
index 13a8807c7..36708f426 100644
--- a/monitor/sdp.c
+++ b/monitor/sdp.c
@@ -585,6 +585,10 @@ static void service_rsp(const struct l2cap_frame *frame, struct tid_data *tid)
 	}
 
 	count = get_be16(frame->data + 2);
+	if (count * 4 > frame->size) {
+		print_text(COLOR_ERROR, "invalid record count");
+                return;
+	}
 
 	print_field("Total record count: %d", get_be16(frame->data));
 	print_field("Current record count: %d", count);
-- 
2.19.1

Places

File 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch of Package bluez (Revision fa2aaf081c7bbb904715d6bc039bb688)

Places