[BlueZ] gatt: sanitize input at profile registration

Commit Message

Andreas Kemnade Feb. 26, 2022, 10:08 a.m. UTC

Check whether type of UUIDs property of GattProfile1 object
is correct.
---
 src/gatt-database.c | 5 +++++
 1 file changed, 5 insertions(+)

Comments

[e-mail] Feb. 26, 2022, 12:34 p.m. UTC | #1

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=618281

---Test result---

Test Summary:
CheckPatch                    PASS      0.57 seconds
GitLint                       PASS      0.38 seconds
Prep - Setup ELL              PASS      51.10 seconds
Build - Prep                  PASS      0.62 seconds
Build - Configure             PASS      10.09 seconds
Build - Make                  PASS      1750.78 seconds
Make Check                    PASS      12.32 seconds
Make Check w/Valgrind         PASS      517.24 seconds
Make Distcheck                PASS      280.39 seconds
Build w/ext ELL - Configure   PASS      10.10 seconds
Build w/ext ELL - Make        PASS      1730.19 seconds
Incremental Build with patchesPASS      0.00 seconds



---
Regards,
Linux Bluetooth

Patch

diff --git a/src/gatt-database.c b/src/gatt-database.c
index 481222d44..485af04ea 100644
--- a/src/gatt-database.c
+++ b/src/gatt-database.c
@@ -3423,6 +3423,11 @@  static struct external_profile *create_profile(struct gatt_app *app,
 		goto fail;
 	}
 
+	if (dbus_message_iter_get_arg_type(&iter) != DBUS_TYPE_ARRAY) {
+		DBG("UUIDs wrongly formatted");
+		goto fail;
+	}
+
 	dbus_message_iter_recurse(&iter, &array);
 
 	while (dbus_message_iter_get_arg_type(&array) == DBUS_TYPE_STRING) {