* [PATCH 08/12] btmon: fix segfault caused by integer undeflow
@ 2018-10-16 20:23 Matias Karhumaa
0 siblings, 0 replies; only message in thread
From: Matias Karhumaa @ 2018-10-16 20:23 UTC (permalink / raw)
To: linux-bluetooth
Fix segfault caused by integer underflow. Fix is to check that
rsp->num_codecs + 3 is not bigger than size before subtracting.
Crash was found by fuzzing btmon with AFL.
---
monitor/packet.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/monitor/packet.c b/monitor/packet.c
index 461f5e84b..1e9f9d9e4 100644
--- a/monitor/packet.c
+++ b/monitor/packet.c
@@ -5832,6 +5832,11 @@ static void read_local_codecs_rsp(const void *data, uint8_t size)
const struct bt_hci_rsp_read_local_codecs *rsp = data;
uint8_t i, num_vnd_codecs;
+ if (rsp->num_codecs + 3 > size) {
+ print_field("Invalid number of codecs.");
+ return;
+ }
+
print_status(rsp->status);
print_field("Number of supported codecs: %d", rsp->num_codecs);
--
2.17.1
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2018-10-16 20:19 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-10-16 20:23 [PATCH 08/12] btmon: fix segfault caused by integer undeflow Matias Karhumaa
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.