Re: [PATCH] bap: Fix stack buffer overflow in BlueZ LE Audio BASE parser

[patchwork-bot+bluetooth@kernel.org]

Hello:

This patch was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Thu, 27 Aug 2026 16:58:00 +0200 you wrote:
> A stack buffer overflow (CWE-121) in bap_sink_match_allocation() in
> src/shared/bap.c allows an attacker within BLE range to write ~195
> attacker-controlled bytes past a 4-byte stack buffer in bluetoothd
> with no pairing, no connection, and no user interaction. The BAP
> profile auto-syncs to any device advertising the BCAAS UUID.
> 
> bap_sink_match_allocation() copies the value of an
> Audio_Channel_Allocation LTV (type 0x03) into a 4-byte uint32_t stack
> local using the LTV's attacker-controlled length byte as the memcpy
> size, with no upper bound check:
> 	// src/shared/bap.c:7767
> 	memcpy(&location32, v, l);  // l attacker-controlled, no upper bound
> 
> [...]

Here is the summary with links:
  - bap: Fix stack buffer overflow in BlueZ LE Audio BASE parser
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=627f9fae7895

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html