[BlueZ,1/7] monitor: Fix out-of-bound read in print_le_states

Commit Message

Ildar Kamaletdinov April 1, 2022, 11:14 a.m. UTC

Accessing le_states_desc_table array with value 15 can cause
out-of-bound read because current size of array is 14.

Currently this cannot lead to any problems becase we do no have such
state in le_states_comb_table but this could be changed in future and
raise described problem.

Found by Linux Verification Center (linuxtesting.org) with the SVACE
static analysis tool.
---
 monitor/packet.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

Comments

[e-mail] April 1, 2022, 12:46 p.m. UTC | #1

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=628169

---Test result---

Test Summary:
CheckPatch                    PASS      9.84 seconds
GitLint                       PASS      6.66 seconds
Prep - Setup ELL              PASS      43.31 seconds
Build - Prep                  PASS      0.69 seconds
Build - Configure             PASS      8.81 seconds
Build - Make                  FAIL      79.44 seconds
Make Check                    FAIL      1.17 seconds
Make Check w/Valgrind         FAIL      65.80 seconds
Make Distcheck                PASS      231.36 seconds
Build w/ext ELL - Configure   PASS      8.78 seconds
Build w/ext ELL - Make        FAIL      79.82 seconds
Incremental Build with patchesFAIL      4376.50 seconds

Details
##############################
Test: Build - Make - FAIL
Desc: Build the BlueZ source tree
Output:
tools/bluemoon.c: In function ‘request_firmware’:
tools/bluemoon.c:495:17: error: comparison of integer expressions of different signedness: ‘__off_t’ {aka ‘long int’} and ‘long unsigned int’ [-Werror=sign-compare]
  495 |  if (st.st_size > (SIZE_MAX - 4)) {
      |                 ^
tools/bluemoon.c: In function ‘analyze_firmware’:
tools/bluemoon.c:884:17: error: comparison of integer expressions of different signedness: ‘__off_t’ {aka ‘long int’} and ‘long unsigned int’ [-Werror=sign-compare]
  884 |  if (st.st_size > (SIZE_MAX - 3)) {
      |                 ^
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7277: tools/bluemoon.o] Error 1
make: *** [Makefile:4310: all] Error 2


##############################
Test: Make Check - FAIL
Desc: Run 'make check'
Output:
tools/bluemoon.c: In function ‘request_firmware’:
tools/bluemoon.c:495:17: error: comparison of integer expressions of different signedness: ‘__off_t’ {aka ‘long int’} and ‘long unsigned int’ [-Werror=sign-compare]
  495 |  if (st.st_size > (SIZE_MAX - 4)) {
      |                 ^
tools/bluemoon.c: In function ‘analyze_firmware’:
tools/bluemoon.c:884:17: error: comparison of integer expressions of different signedness: ‘__off_t’ {aka ‘long int’} and ‘long unsigned int’ [-Werror=sign-compare]
  884 |  if (st.st_size > (SIZE_MAX - 3)) {
      |                 ^
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7277: tools/bluemoon.o] Error 1
make: *** [Makefile:11283: check] Error 2


##############################
Test: Make Check w/Valgrind - FAIL
Desc: Run 'make check' with Valgrind
Output:
tools/bluemoon.c: In function ‘request_firmware’:
tools/bluemoon.c:495:17: error: comparison of integer expressions of different signedness: ‘__off_t’ {aka ‘long int’} and ‘long unsigned int’ [-Werror=sign-compare]
  495 |  if (st.st_size > (SIZE_MAX - 4)) {
      |                 ^
tools/bluemoon.c: In function ‘analyze_firmware’:
tools/bluemoon.c:884:17: error: comparison of integer expressions of different signedness: ‘__off_t’ {aka ‘long int’} and ‘long unsigned int’ [-Werror=sign-compare]
  884 |  if (st.st_size > (SIZE_MAX - 3)) {
      |                 ^
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7277: tools/bluemoon.o] Error 1
make: *** [Makefile:4310: all] Error 2


##############################
Test: Build w/ext ELL - Make - FAIL
Desc: Build BlueZ source with '--enable-external-ell' configuration
Output:
tools/bluemoon.c: In function ‘request_firmware’:
tools/bluemoon.c:495:17: error: comparison of integer expressions of different signedness: ‘__off_t’ {aka ‘long int’} and ‘long unsigned int’ [-Werror=sign-compare]
  495 |  if (st.st_size > (SIZE_MAX - 4)) {
      |                 ^
tools/bluemoon.c: In function ‘analyze_firmware’:
tools/bluemoon.c:884:17: error: comparison of integer expressions of different signedness: ‘__off_t’ {aka ‘long int’} and ‘long unsigned int’ [-Werror=sign-compare]
  884 |  if (st.st_size > (SIZE_MAX - 3)) {
      |                 ^
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7277: tools/bluemoon.o] Error 1
make: *** [Makefile:4310: all] Error 2


##############################
Test: Incremental Build with patches - FAIL
Desc: Incremental build per patch in the series
Output:
tools/bluemoon.c: In function ‘request_firmware’:
tools/bluemoon.c:495:17: error: comparison of integer expressions of different signedness: ‘__off_t’ {aka ‘long int’} and ‘long unsigned int’ [-Werror=sign-compare]
  495 |  if (st.st_size > (SIZE_MAX - 4)) {
      |                 ^
tools/bluemoon.c: In function ‘analyze_firmware’:
tools/bluemoon.c:884:17: error: comparison of integer expressions of different signedness: ‘__off_t’ {aka ‘long int’} and ‘long unsigned int’ [-Werror=sign-compare]
  884 |  if (st.st_size > (SIZE_MAX - 3)) {
      |                 ^
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7277: tools/bluemoon.o] Error 1
make: *** [Makefile:4310: all] Error 2




---
Regards,
Linux Bluetooth

Patch

diff --git a/monitor/packet.c b/monitor/packet.c
index b7431b57d..1f04063d3 100644
--- a/monitor/packet.c
+++ b/monitor/packet.c
@@ -2816,7 +2816,8 @@  static const struct {
 static void print_le_states(const uint8_t *states_array)
 {
 	uint64_t mask, states = 0;
-	int i, n;
+	int i = 0;
+	size_t n = 0;
 
 	for (i = 0; i < 8; i++)
 		states |= ((uint64_t) states_array[i]) << (i * 8);
@@ -2828,12 +2829,12 @@  static void print_le_states(const uint8_t *states_array)
 	for (i = 0; le_states_comb_table[i].states; i++) {
 		uint64_t val = (((uint64_t) 1) << le_states_comb_table[i].bit);
 		const char *str[3] = { NULL, };
-		int num = 0;
+		size_t num = 0;
 
 		if (!(states & val))
 			continue;
 
-		for (n = 0; n < 16; n++) {
+		for (n = 0; n < ARRAY_SIZE(le_states_desc_table); n++) {
 			if (le_states_comb_table[i].states & (1 << n))
 				str[num++] = le_states_desc_table[n].str;
 		}