diff options
author | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2018-09-28 16:08:32 +0300 |
---|---|---|
committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2018-11-02 13:09:28 +0200 |
commit | 6c7243fb6ab90b7b855cead98c66394fedea135f (patch) | |
tree | 9ed4ab10507a9abc06344f59c9f3e2cc408f26ca /lib | |
parent | 7bf67b32709d828fafa26256b4c78331760c6e93 (diff) | |
download | bluez-6c7243fb6ab90b7b855cead98c66394fedea135f.tar.gz |
sdp: Fix buffer overflow
sdp_append_buf shall check if there is enough space to store the data
before copying it.
An independent security researcher, Julian Rauchberger, has reported
this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure
program.
Diffstat (limited to 'lib')
-rw-r--r-- | lib/sdp.c | 6 |
1 files changed, 6 insertions, 0 deletions
@@ -2834,6 +2834,12 @@ void sdp_append_to_buf(sdp_buf_t *dst, uint8_t *data, uint32_t len) SDPDBG("Append src size: %d", len); SDPDBG("Append dst size: %d", dst->data_size); SDPDBG("Dst buffer size: %d", dst->buf_size); + + if (dst->data_size + len > dst->buf_size) { + SDPERR("Cannot append"); + return; + } + if (dst->data_size == 0 && dtd == 0) { /* create initial sequence */ *p = SDP_SEQ8; |