All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH BlueZ v1 1/4] gatt-server: Check prepare write length before reallocating
@ 2026-09-10 18:42 Luiz Augusto von Dentz
  2026-09-10 18:42 ` [PATCH BlueZ v1 2/4] adapter: Unify the A2DP admin allowlist UUID mapping Luiz Augusto von Dentz
                   ` (3 more replies)
  0 siblings, 4 replies; 5+ messages in thread
From: Luiz Augusto von Dentz @ 2026-09-10 18:42 UTC (permalink / raw)
  To: linux-bluetooth

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

append_prep_data() grew the buffer and copied the new fragment into it
before rejecting a total length above UINT16_MAX. On overflow the
allocation had already been enlarged and written while prep_data->length
was left at its previous value, desynchronising the buffer from its
tracked size.

Move the bound check ahead of the realloc() so an oversized prepare
write queue is rejected without touching the buffer.

Assisted-by: opencode:claude-opus-5
---
 src/shared/gatt-server.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/src/shared/gatt-server.c b/src/shared/gatt-server.c
index 516fceb8ed00..fde791aae867 100644
--- a/src/shared/gatt-server.c
+++ b/src/shared/gatt-server.c
@@ -1207,6 +1207,8 @@ static bool append_prep_data(struct prep_write_data *prep_data, uint16_t handle,
 		return true;
 
 	len = (size_t)prep_data->length + (size_t)length;
+	if (len > UINT16_MAX)
+		return false;
 
 	val = realloc(prep_data->value, len);
 	if (!val)
@@ -1215,9 +1217,6 @@ static bool append_prep_data(struct prep_write_data *prep_data, uint16_t handle,
 	memcpy(val + prep_data->length, value, length);
 
 	prep_data->value = val;
-
-	if (len > UINT16_MAX)
-		return false;
 	prep_data->length = (uint16_t)len;
 
 	return true;
-- 
2.55.0


^ permalink raw reply related	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2026-09-10 20:06 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-10 18:42 [PATCH BlueZ v1 1/4] gatt-server: Check prepare write length before reallocating Luiz Augusto von Dentz
2026-09-10 18:42 ` [PATCH BlueZ v1 2/4] adapter: Unify the A2DP admin allowlist UUID mapping Luiz Augusto von Dentz
2026-09-10 18:42 ` [PATCH BlueZ v1 3/4] battery: Document the unknown sentinels and fix a stale name Luiz Augusto von Dentz
2026-09-10 18:42 ` [PATCH BlueZ v1 4/4] client/bluetoothctl: Declare the controller helper in its own header Luiz Augusto von Dentz
2026-09-10 20:06 ` [BlueZ,v1,1/4] gatt-server: Check prepare write length before reallocating bluez.test.bot

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.