All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH BlueZ 1/2] lib: Fix out-of-bounds write when concatenating commands
@ 2025-08-24 20:09 Arkadiusz Bokowy
  2025-08-24 20:09 ` [PATCH BlueZ 2/2] lib: Synchronize supported commands with Core Spec 6.0 Arkadiusz Bokowy
                   ` (2 more replies)
  0 siblings, 3 replies; 5+ messages in thread
From: Arkadiusz Bokowy @ 2025-08-24 20:09 UTC (permalink / raw)
  To: linux-bluetooth; +Cc: Arkadiusz Bokowy

This commit fixes the hci_commandstostr() command by writing new line
character in place of trailing space when wrapping long lines. Previous
approach was to append new line character to existing string, which
caused buffer overflow when there was more than 9 lines in the output
string.

Also, the last trailing space is removed in order to return
trailing-spaces-free string to the caller.
---
 lib/bluetooth/hci.c     | 25 ++++++++++++++++++-------
 lib/bluetooth/hci_lib.h |  2 +-
 2 files changed, 19 insertions(+), 8 deletions(-)

diff --git a/lib/bluetooth/hci.c b/lib/bluetooth/hci.c
index f9feaf185..a1eccaf1e 100644
--- a/lib/bluetooth/hci.c
+++ b/lib/bluetooth/hci.c
@@ -604,18 +604,26 @@ char *hci_cmdtostr(unsigned int cmd)
 	return hci_uint2str(commands_map, cmd);
 }
 
-char *hci_commandstostr(uint8_t *commands, char *pref, int width)
+char *hci_commandstostr(const uint8_t *commands, const char *pref, int width)
 {
 	unsigned int maxwidth = width - 3;
 	const hci_map *m;
 	char *off, *ptr, *str;
-	int size = 10;
+	int size = 1;
+	int pref_len;
+
+	if (pref) {
+		pref_len = strlen(pref);
+	} else {
+		pref_len = 0;
+		pref = "";
+	}
 
 	m = commands_map;
 
 	while (m->str) {
 		if (commands[m->val / 8] & (1 << (m->val % 8)))
-			size += strlen(m->str) + (pref ? strlen(pref) : 0) + 3;
+			size += pref_len + strlen(m->str) + 3;
 		m++;
 	}
 
@@ -625,9 +633,7 @@ char *hci_commandstostr(uint8_t *commands, char *pref, int width)
 
 	ptr = str; *ptr = '\0';
 
-	if (pref)
-		ptr += sprintf(ptr, "%s", pref);
-
+	ptr += sprintf(ptr, "%s", pref);
 	off = ptr;
 
 	m = commands_map;
@@ -635,7 +641,8 @@ char *hci_commandstostr(uint8_t *commands, char *pref, int width)
 	while (m->str) {
 		if (commands[m->val / 8] & (1 << (m->val % 8))) {
 			if (strlen(off) + strlen(m->str) > maxwidth) {
-				ptr += sprintf(ptr, "\n%s", pref ? pref : "");
+				ptr = ptr - 1;
+				ptr += sprintf(ptr, "\n%s", pref);
 				off = ptr;
 			}
 			ptr += sprintf(ptr, "'%s' ", m->str);
@@ -643,6 +650,10 @@ char *hci_commandstostr(uint8_t *commands, char *pref, int width)
 		m++;
 	}
 
+	if (ptr != str)
+		/* Trim trailing space. */
+		ptr[-1] = '\0';
+
 	return str;
 }
 
diff --git a/lib/bluetooth/hci_lib.h b/lib/bluetooth/hci_lib.h
index baf3d3e12..2cb660786 100644
--- a/lib/bluetooth/hci_lib.h
+++ b/lib/bluetooth/hci_lib.h
@@ -146,7 +146,7 @@ char *hci_lmtostr(unsigned int ptype);
 int hci_strtolm(char *str, unsigned int *val);
 
 char *hci_cmdtostr(unsigned int cmd);
-char *hci_commandstostr(uint8_t *commands, char *pref, int width);
+char *hci_commandstostr(const uint8_t *commands, const char *pref, int width);
 
 char *hci_vertostr(unsigned int ver);
 int hci_strtover(char *str, unsigned int *ver);
-- 
2.47.2


^ permalink raw reply related	[flat|nested] 5+ messages in thread
end of thread, other threads:[~2025-08-25 16:50 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-08-24 20:09 [PATCH BlueZ 1/2] lib: Fix out-of-bounds write when concatenating commands Arkadiusz Bokowy
2025-08-24 20:09 ` [PATCH BlueZ 2/2] lib: Synchronize supported commands with Core Spec 6.0 Arkadiusz Bokowy
2025-08-24 21:43 ` [BlueZ,1/2] lib: Fix out-of-bounds write when concatenating commands bluez.test.bot
2025-08-25 15:27 ` [PATCH BlueZ v2 1/2] " Arkadiusz Bokowy
2025-08-25 16:50   ` [BlueZ,v2,1/2] " bluez.test.bot

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.