btmon: fix segfault caused by integer underflow

Fix segfault caused by integer underflow in decode_data_element function
of monitor/sdp.c.

Fix is to check that elemlen is not bigger than size before subtracting
elemlen from size. Also search_bytes + attr_bytes should not be bigger
than frame->size.

This bug can be triggered locally reading malformed btmon capture file
and also over the air by sending specifically crafted SDP Search
Attribute response to device running btmon.

This bug was found by fuzzing btmon with AFL.

1 files changed, 10 insertions, 0 deletions

diff --git a/monitor/sdp.c b/monitor/sdp.c
index df5ccdb71..13a8807c7 100644
--- a/monitor/sdp.c
+++ b/monitor/sdp.c
@@ -309,6 +309,11 @@ static void decode_data_elements(uint32_t position, uint8_t indent,
 		break;
 	}
 
+	if (elemlen > size) {
+		print_text(COLOR_ERROR, "invalid data element size");
+		return;
+	}
+
 	data += elemlen;
 	size -= elemlen;
 
@@ -655,6 +660,11 @@ static void search_attr_req(const struct l2cap_frame *frame,
 				frame->size - search_bytes - 2);
 	print_field("Attribute list: [len %d]", attr_bytes);
 
+	if (search_bytes + attr_bytes > frame->size) {
+		print_text(COLOR_ERROR, "invalid attribute list length");
+		return;
+	}
+
 	decode_data_elements(0, 2, frame->data + search_bytes + 2,
 						attr_bytes, NULL);