[PATCH BlueZ] gatt-server: Fix integer overflow

[PATCH BlueZ] gatt-server: Fix integer overflow

[zuohsh]

By using size_t for realloc len and rejecting allocations exceeding
UINT16_MAX , to prevent truncation into the uint16_t field.
---
 src/shared/gatt-server.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/src/shared/gatt-server.c b/src/shared/gatt-server.c
index 709a8f94b..328755566 100644
--- a/src/shared/gatt-server.c
+++ b/src/shared/gatt-server.c
@@ -1174,12 +1174,12 @@ static bool append_prep_data(struct prep_write_data *prep_data, uint16_t handle,
 					uint16_t length, uint8_t *value)
 {
 	uint8_t *val;
-	uint16_t len;
+	size_t len;
 
 	if (!length)
 		return true;
 
-	len = prep_data->length + length;
+	len = (size_t)prep_data->length + (size_t)length;
 
 	val = realloc(prep_data->value, len);
 	if (!val)
@@ -1188,7 +1188,11 @@ static bool append_prep_data(struct prep_write_data *prep_data, uint16_t handle,
 	memcpy(val + prep_data->length, value, length);
 
 	prep_data->value = val;
-	prep_data->length = len;
+
+	if (len > UINT16_MAX) {
+		return false;
+	}
+	prep_data->length = (uint16_t)len;
 
 	return true;
 }
-- 
2.43.0

RE: [BlueZ] gatt-server: Fix integer overflow

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 2651 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1133054

---Test result---

Test Summary:
CheckPatch                    FAIL      0.42 seconds
GitLint                       PASS      0.30 seconds
BuildEll                      PASS      20.28 seconds
BluezMake                     PASS      490.77 seconds
MakeCheck                     PASS      1.10 seconds
MakeDistcheck                 PASS      150.84 seconds
CheckValgrind                 PASS      147.90 seconds
CheckSmatch                   WARNING   291.15 seconds
bluezmakeextell               PASS      93.95 seconds
IncrementalBuild              PASS      495.99 seconds
ScanBuild                     PASS      863.79 seconds

Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
[BlueZ] gatt-server: Fix integer overflow
WARNING:BRACES: braces {} are not necessary for single statement blocks
#106: FILE: src/shared/gatt-server.c:1192:
+	if (len > UINT16_MAX) {
+		return false;
+	}

/github/workspace/src/patch/14705742.patch total: 0 errors, 1 warnings, 26 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

/github/workspace/src/patch/14705742.patch has style problems, please review.

NOTE: Ignored message types: COMMIT_MESSAGE COMPLEX_MACRO CONST_STRUCT FILE_PATH_CHANGES MISSING_SIGN_OFF PREFER_PACKED SPDX_LICENSE_TAG SPLIT_STRING SSCANF_TO_KSTRTO

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.


##############################
Test: CheckSmatch - WARNING
Desc: Run smatch tool with source
Output:
src/shared/gatt-server.c:271:25: warning: Variable length array is used.src/shared/gatt-server.c:614:25: warning: Variable length array is used.src/shared/gatt-server.c:712:25: warning: Variable length array is used.src/shared/gatt-server.c:271:25: warning: Variable length array is used.src/shared/gatt-server.c:614:25: warning: Variable length array is used.src/shared/gatt-server.c:712:25: warning: Variable length array is used.src/shared/gatt-server.c:271:25: warning: Variable length array is used.src/shared/gatt-server.c:614:25: warning: Variable length array is used.src/shared/gatt-server.c:712:25: warning: Variable length array is used.


https://github.com/bluez/bluez/pull/2343

---
Regards,
Linux Bluetooth

[PATCH v2] gatt-server: Fix integer overflow

[zuohsh]

By using size_t for realloc len and rejecting allocations exceeding
UINT16_MAX , to prevent truncation into the uint16_t field.
---
 src/shared/gatt-server.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/src/shared/gatt-server.c b/src/shared/gatt-server.c
index 709a8f94b..1ec826a69 100644
--- a/src/shared/gatt-server.c
+++ b/src/shared/gatt-server.c
@@ -1174,12 +1174,12 @@ static bool append_prep_data(struct prep_write_data *prep_data, uint16_t handle,
 					uint16_t length, uint8_t *value)
 {
 	uint8_t *val;
-	uint16_t len;
+	size_t len;

 	if (!length)
 		return true;

-	len = prep_data->length + length;
+	len = (size_t)prep_data->length + (size_t)length;

 	val = realloc(prep_data->value, len);
 	if (!val)
@@ -1188,7 +1188,10 @@ static bool append_prep_data(struct prep_write_data *prep_data, uint16_t handle,
 	memcpy(val + prep_data->length, value, length);

 	prep_data->value = val;
-	prep_data->length = len;
+
+	if (len > UINT16_MAX)
+		return false;
+	prep_data->length = (uint16_t)len;

 	return true;
 }
--
2.43.0

Handle the CheckPatch failure reported by BluezTestBot.

RE: [v2] gatt-server: Fix integer overflow

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1745 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1149440

---Test result---

Test Summary:
CheckPatch                    PASS      0.40 seconds
GitLint                       PASS      0.31 seconds
BuildEll                      PASS      16.56 seconds
BluezMake                     PASS      467.83 seconds
MakeCheck                     PASS      0.87 seconds
MakeDistcheck                 PASS      125.66 seconds
CheckValgrind                 PASS      120.13 seconds
CheckSmatch                   WARNING   234.02 seconds
bluezmakeextell               PASS      76.32 seconds
IncrementalBuild              PASS      495.77 seconds
ScanBuild                     PASS      704.75 seconds

Details
##############################
Test: CheckSmatch - WARNING
Desc: Run smatch tool with source
Output:
src/shared/gatt-server.c:271:25: warning: Variable length array is used.src/shared/gatt-server.c:614:25: warning: Variable length array is used.src/shared/gatt-server.c:712:25: warning: Variable length array is used.src/shared/gatt-server.c:271:25: warning: Variable length array is used.src/shared/gatt-server.c:614:25: warning: Variable length array is used.src/shared/gatt-server.c:712:25: warning: Variable length array is used.src/shared/gatt-server.c:271:25: warning: Variable length array is used.src/shared/gatt-server.c:614:25: warning: Variable length array is used.src/shared/gatt-server.c:712:25: warning: Variable length array is used.


https://github.com/bluez/bluez/pull/2422

---
Regards,
Linux Bluetooth

[PATCH v3] gatt-server: Fix integer overflow and 3 CI VLA wanings

[zuohsh]

By using size_t for realloc len and rejecting allocations exceeding
UINT16_MAX , to prevent truncation into the uint16_t field.

Fix CI warnings: Variable length array is used, use malloc/free instead.
---
 src/shared/gatt-server.c | 42 ++++++++++++++++++++++++++++++++++------
 1 file changed, 36 insertions(+), 6 deletions(-)

diff --git a/src/shared/gatt-server.c b/src/shared/gatt-server.c
index 709a8f94b..516fceb8e 100644
--- a/src/shared/gatt-server.c
+++ b/src/shared/gatt-server.c
@@ -268,7 +268,7 @@ static void read_by_grp_type_cb(struct bt_att_chan *chan, uint16_t mtu,
 	uint16_t start, end;
 	bt_uuid_t type;
 	bt_uuid_t prim, snd;
-	uint8_t rsp_pdu[mtu];
+	uint8_t *rsp_pdu = NULL;
 	uint16_t rsp_len;
 	uint8_t ecode = 0;
 	uint16_t ehandle = 0;
@@ -319,6 +319,12 @@ static void read_by_grp_type_cb(struct bt_att_chan *chan, uint16_t mtu,
 		goto error;
 	}

+	rsp_pdu = malloc(mtu);
+	if (!rsp_pdu) {
+		ecode = BT_ATT_ERROR_INSUFFICIENT_RESOURCES;
+		goto error;
+	}
+
 	if (!encode_read_by_grp_type_rsp(server->db, q, server->att, mtu,
 							rsp_pdu, &rsp_len)) {
 		ecode = BT_ATT_ERROR_UNLIKELY;
@@ -330,11 +336,14 @@ static void read_by_grp_type_cb(struct bt_att_chan *chan, uint16_t mtu,
 	bt_att_chan_send_rsp(chan, BT_ATT_OP_READ_BY_GRP_TYPE_RSP,
 						rsp_pdu, rsp_len);

+	free(rsp_pdu);
+
 	return;

 error:
 	queue_destroy(q, NULL);
 	bt_att_chan_send_error_rsp(chan, opcode, ehandle, ecode);
+	free(rsp_pdu);
 }

 static void async_read_op_destroy(struct async_read_op *op)
@@ -611,7 +620,7 @@ static void find_info_cb(struct bt_att_chan *chan, uint16_t mtu, uint8_t opcode,
 {
 	struct bt_gatt_server *server = user_data;
 	uint16_t start, end;
-	uint8_t rsp_pdu[mtu];
+	uint8_t *rsp_pdu = NULL;
 	uint16_t rsp_len;
 	uint8_t ecode = 0;
 	uint16_t ehandle = 0;
@@ -648,6 +657,12 @@ static void find_info_cb(struct bt_att_chan *chan, uint16_t mtu, uint8_t opcode,
 		goto error;
 	}

+	rsp_pdu = malloc(mtu);
+	if (!rsp_pdu) {
+		ecode = BT_ATT_ERROR_INSUFFICIENT_RESOURCES;
+		goto error;
+	}
+
 	if (!encode_find_info_rsp(server->db, q, mtu, rsp_pdu, &rsp_len)) {
 		ecode = BT_ATT_ERROR_UNLIKELY;
 		goto error;
@@ -657,11 +672,14 @@ static void find_info_cb(struct bt_att_chan *chan, uint16_t mtu, uint8_t opcode,

 	queue_destroy(q, NULL);

+	free(rsp_pdu);
+
 	return;

 error:
 	bt_att_chan_send_error_rsp(chan, opcode, ehandle, ecode);
 	queue_destroy(q, NULL);
+	free(rsp_pdu);

 }

@@ -709,7 +727,7 @@ static void find_by_type_val_cb(struct bt_att_chan *chan, uint16_t mtu,
 	struct bt_gatt_server *server = user_data;
 	uint16_t start, end, uuid16;
 	struct find_by_type_val_data data;
-	uint8_t rsp_pdu[mtu];
+	uint8_t *rsp_pdu = NULL;
 	uint16_t ehandle = 0;
 	bt_uuid_t uuid;

@@ -718,6 +736,12 @@ static void find_by_type_val_cb(struct bt_att_chan *chan, uint16_t mtu,
 		goto error;
 	}

+	rsp_pdu = malloc(mtu);
+	if (!rsp_pdu) {
+		data.ecode = BT_ATT_ERROR_INSUFFICIENT_RESOURCES;
+		goto error;
+	}
+
 	data.pdu = rsp_pdu;
 	data.len = 0;
 	data.mtu = mtu;
@@ -752,10 +776,13 @@ static void find_by_type_val_cb(struct bt_att_chan *chan, uint16_t mtu,
 	bt_att_chan_send_rsp(chan, BT_ATT_OP_FIND_BY_TYPE_RSP,
 					data.pdu, data.len);

+	free(rsp_pdu);
+
 	return;

 error:
 	bt_att_chan_send_error_rsp(chan, opcode, ehandle, data.ecode);
+	free(rsp_pdu);
 }

 static void async_write_op_destroy(struct async_write_op *op)
@@ -1174,12 +1201,12 @@ static bool append_prep_data(struct prep_write_data *prep_data, uint16_t handle,
 					uint16_t length, uint8_t *value)
 {
 	uint8_t *val;
-	uint16_t len;
+	size_t len;

 	if (!length)
 		return true;

-	len = prep_data->length + length;
+	len = (size_t)prep_data->length + (size_t)length;

 	val = realloc(prep_data->value, len);
 	if (!val)
@@ -1188,7 +1215,10 @@ static bool append_prep_data(struct prep_write_data *prep_data, uint16_t handle,
 	memcpy(val + prep_data->length, value, length);

 	prep_data->value = val;
-	prep_data->length = len;
+
+	if (len > UINT16_MAX)
+		return false;
+	prep_data->length = (uint16_t)len;

 	return true;
 }
--
2.43.0

Add fixing for CI reported wanings: https://github.com/bluez/bluez/actions/runs/32445843490/job/96665153549?pr=2422
2026-08-21T04:46:41.2241065Z src/shared/gatt-server.c:271:25: warning: Variable length array is used.src/shared/gatt-server.c:614:25: warning: Variable length array is used.src/shared/gatt-server.c:712:25: warning: Variable length array is used.src/shared/gatt-server.c:271:25: warning: Variable length array is used.src/shared/gatt-server.c:614:25: warning: Variable length array is used.src/shared/gatt-server.c:712:25: warning: Variable length array is used.src/shared/gatt-server.c:271:25: warning: Variable length array is used.src/shared/gatt-server.c:614:25: warning: Variable length array is used.src/shared/gatt-server.c:712:25: warning: Variable length array is used.

RE: [v3] gatt-server: Fix integer overflow and 3 CI VLA wanings

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1856 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1149533

---Test result---

Test Summary:
CheckPatch                    PASS      0.48 seconds
GitLint                       FAIL      0.32 seconds
BuildEll                      PASS      20.23 seconds
BluezMake                     PASS      575.47 seconds
MakeCheck                     PASS      1.09 seconds
MakeDistcheck                 PASS      154.83 seconds
CheckValgrind                 PASS      156.52 seconds
CheckSmatch                   PASS      307.18 seconds
bluezmakeextell               PASS      100.11 seconds
IncrementalBuild              PASS      579.53 seconds
ScanBuild                     PASS      952.04 seconds

Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[v3] gatt-server: Fix integer overflow and 3 CI VLA wanings

14: B1 Line exceeds max length (677>80): "2026-08-21T04:46:41.2241065Z src/shared/gatt-server.c:271:25: warning: Variable length array is used.src/shared/gatt-server.c:614:25: warning: Variable length array is used.src/shared/gatt-server.c:712:25: warning: Variable length array is used.src/shared/gatt-server.c:271:25: warning: Variable length array is used.src/shared/gatt-server.c:614:25: warning: Variable length array is used.src/shared/gatt-server.c:712:25: warning: Variable length array is used.src/shared/gatt-server.c:271:25: warning: Variable length array is used.src/shared/gatt-server.c:614:25: warning: Variable length array is used.src/shared/gatt-server.c:712:25: warning: Variable length array is used."


https://github.com/bluez/bluez/pull/2423

---
Regards,
Linux Bluetooth