[PATCH BlueZ v2] sdp: fix overflow in sdp_extract_seqtype()

[Martin Brodeur <admin@fluentlogic.org>]

bt_get_be32() returns uint32_t. Assigning the result directly
to the int *size parameter sign-extends values greater than
INT_MAX to negative, bypassing sequence-length sanity checks
in extract_seq() and sdp_extract_pdu() callers.

Store the result in a uint32_t first and reject values that
exceed INT_MAX before assigning to *size.

Reported-by: Martin Brodeur <admin@fluentlogic.org>
---
 lib/bluetooth/sdp.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/lib/bluetooth/sdp.c b/lib/bluetooth/sdp.c
index 7210ce0..3295fc0 100644
--- a/lib/bluetooth/sdp.c
+++ b/lib/bluetooth/sdp.c
@@ -1249,7 +1249,15 @@ int sdp_extract_seqtype(const uint8_t *buf, int bufsize, uint8_t *dtdp, int *siz
 			SDPERR("Unexpected end of packet");
 			return 0;
 		}
-		*size = bt_get_be32(buf);
+		{
+			uint32_t val32 = bt_get_be32(buf);
+
+			if (val32 > INT_MAX) {
+				SDPERR("Sequence length overflow");
+				return 0;
+			}
+			*size = (int) val32;
+		}
 		scanned += sizeof(uint32_t);
 		break;
 	default:
-- 
2.39.5 (Apple Git-154)