All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH BlueZ] gatt-client: Check length of notify multiple op
@ 2021-06-11 12:30 Sebastian Urban
  2021-06-11 12:53 ` [BlueZ] " bluez.test.bot
  0 siblings, 1 reply; 4+ messages in thread
From: Sebastian Urban @ 2021-06-11 12:30 UTC (permalink / raw)
  To: linux-bluetooth; +Cc: Sebastian Urban

Check that specfied length of value in received data does not exceed
length of PDU. Otherwise data may be read from beyond the end of the
buffer.
---
 src/shared/gatt-client.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/shared/gatt-client.c b/src/shared/gatt-client.c
index 9511ea8ca..094922486 100644
--- a/src/shared/gatt-client.c
+++ b/src/shared/gatt-client.c
@@ -2173,6 +2173,9 @@ static void notify_cb(struct bt_att_chan *chan, uint8_t opcode,
 			length -= 2;
 			pdu += 2;
 
+			if (data.len > length)
+				data.len = length;
+
 			data.data = pdu;
 
 			queue_foreach(client->notify_list, notify_handler,
-- 
2.25.1


^ permalink raw reply related	[flat|nested] 4+ messages in thread

end of thread, other threads:[~2021-06-16 17:00 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-06-11 12:30 [PATCH BlueZ] gatt-client: Check length of notify multiple op Sebastian Urban
2021-06-11 12:53 ` [BlueZ] " bluez.test.bot
2021-06-16 11:22   ` Sebastian Urban
2021-06-16 17:00     ` Luiz Augusto von Dentz

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.