mbox series

[BlueZ,0/1] btdev: Fix set PA data array overflow

Message ID 20240213155803.3159-1-iulia.tanasescu@nxp.com (mailing list archive)
Headers show
Series btdev: Fix set PA data array overflow | expand

Message

Iulia Tanasescu Feb. 13, 2024, 3:58 p.m. UTC 
This fixes an array overflow that can happen if the user issues the
LE Set Periodic Advertising Data command with data length exceeding
31 bytes.

This can be noticed when running the Broadcast Source/Sink scenarios
in bluetoothctl, using emulated controllers: If the source BASE
exceeds 31 bytes, the PA reports received by the Sink looks something
like the following:

> HCI Event: LE Meta Event (0x3e) plen 39
      LE Periodic Advertising Report (0x0f)
        Sync handle: 1
        TX power: 127 dbm (0x7f)
        RSSI: not available (0x7f)
        CTE Type: No Constant Tone Extension (0xff)
        Data status: Incomplete, more data to come
        Data length: 0x1f
        25 16 51 18 e0 99 89 01 01 06 00 00 00 00 10 02
        01 03 02 02 01 03 04 28 00 05 03 03 00 00 00

> HCI Event: LE Meta Event (0x3e) plen 15
      LE Periodic Advertising Report (0x0f)
        Sync handle: 1
        TX power: 127 dbm (0x7f)
        RSSI: not available (0x7f)
        CTE Type: No Constant Tone Extension (0xff)
        Data status: Complete
        Data length: 0x07
        00 00 00 00 00 00 00

The second PA report contains invalid bytes that were read outside
the PA data array.

Iulia Tanasescu (1):
  btdev: Fix set PA data array overflow

 emulator/btdev.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)


base-commit: 41c7f3af0352d3e45f4f10b7584e955a7f5cc696

Comments

patchwork-bot+bluetooth@kernel.org Feb. 13, 2024, 8:50 p.m. UTC | #1 
Hello:

This patch was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Tue, 13 Feb 2024 17:58:02 +0200 you wrote:
> This fixes an array overflow that can happen if the user issues the
> LE Set Periodic Advertising Data command with data length exceeding
> 31 bytes.
> 
> This can be noticed when running the Broadcast Source/Sink scenarios
> in bluetoothctl, using emulated controllers: If the source BASE
> exceeds 31 bytes, the PA reports received by the Sink looks something
> like the following:
> 
> [...]

Here is the summary with links:
  - [BlueZ,1/1] btdev: Fix set PA data array overflow
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=7c49568a2758

You are awesome, thank you!