mbox series

[BlueZ,0/1] Fix crash in iov_append_ltv function

Message ID 20240320210350.101941-1-silviu.barbulescu@nxp.com (mailing list archive)
Headers show
Series Fix crash in iov_append_ltv function | expand

Message

Silviu Florian Barbulescu March 20, 2024, 9:03 p.m. UTC 
Fix function iov_append_ltv crashes because is not reallocating memory
Use util_ltv_push from util.c

[bluetooth]# [NEW] Endpoint /org/bluez/hci0/pac_bcast0
[bluetooth]# Endpoint /local/endpoint/ep0 registered
endpoint.config /org/bluez/hci0/pac_bcast0 /local/endpoint/ep0 48_4_1
[/local/endpoint/ep0] BIG (auto/value): 0
[/local/endpoint/ep0] Enter channel location (value/no): 3
==80806==ERROR: AddressSanitizer: heap-buffer-overflow on
address 0x60200000a8ba at pc 0x561971611e0e bp 0x7ffd45ab1f00
sp 0x7ffd45ab1ef0 WRITE of size 1 at 0x60200000a8ba thread T0
0x561971611e0d in put_u8 src/shared/util.h:254
0x561971611e0d in util_iov_push_u8 src/shared/util.c:534
0x5619715c28f0 in iov_append_ltv client/player.c:3565
0x5619715c28f0 in config_endpoint_channel_location client/player.c:3593
0x5619716226ce in bt_shell_release_prompt src/shared/shell.c:744
0x561971623087 in rl_handler src/shared/shell.c:769

Silviu Florian Barbulescu (1):
  Fix crash in iov_append_ltv function

 client/player.c | 18 +-----------------
 1 file changed, 1 insertion(+), 17 deletions(-)


base-commit: b8ad3490a3507476844d6c6a87b2cb336f7d4eb9

Comments

patchwork-bot+bluetooth@kernel.org March 22, 2024, 10:10 a.m. UTC | #1 
Hello:

This patch was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Wed, 20 Mar 2024 23:03:49 +0200 you wrote:
> Fix function iov_append_ltv crashes because is not reallocating memory
> Use util_ltv_push from util.c
> 
> [bluetooth]# [NEW] Endpoint /org/bluez/hci0/pac_bcast0
> [bluetooth]# Endpoint /local/endpoint/ep0 registered
> endpoint.config /org/bluez/hci0/pac_bcast0 /local/endpoint/ep0 48_4_1
> [/local/endpoint/ep0] BIG (auto/value): 0
> [/local/endpoint/ep0] Enter channel location (value/no): 3
> ==80806==ERROR: AddressSanitizer: heap-buffer-overflow on
> address 0x60200000a8ba at pc 0x561971611e0e bp 0x7ffd45ab1f00
> sp 0x7ffd45ab1ef0 WRITE of size 1 at 0x60200000a8ba thread T0
> 0x561971611e0d in put_u8 src/shared/util.h:254
> 0x561971611e0d in util_iov_push_u8 src/shared/util.c:534
> 0x5619715c28f0 in iov_append_ltv client/player.c:3565
> 0x5619715c28f0 in config_endpoint_channel_location client/player.c:3593
> 0x5619716226ce in bt_shell_release_prompt src/shared/shell.c:744
> 0x561971623087 in rl_handler src/shared/shell.c:769
> 
> [...]

Here is the summary with links:
  - [BlueZ,1/1] Fix crash in iov_append_ltv function
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=bbf198280e70

You are awesome, thank you!