* [bluez/bluez] 61b2d3: avrcp: Fix Out-of-Bounds Read in AVRCP GetFolderIt...
@ 2026-08-14 14:43 hadess
0 siblings, 0 replies; only message in thread
From: hadess @ 2026-08-14 14:43 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/1146125
Home: https://github.com/bluez/bluez
Commit: 61b2d375a947505bc631618cec5dd82a67319eae
https://github.com/bluez/bluez/commit/61b2d375a947505bc631618cec5dd82a67319eae
Author: Bastien Nocera <hadess@hadess.net>
Date: 2026-08-14 (Fri, 14 Aug 2026)
Changed paths:
M profiles/audio/avrcp.c
Log Message:
-----------
avrcp: Fix Out-of-Bounds Read in AVRCP GetFolderItems parsing
If the "Displayable Name Length" is much longer than the size of the PDU
packet we receive, then we might try to memcpy() past the end of the PDU
packet.
Be careful about clamping the name copying to the smallest of:
- length specified in the PDU
- left-over packet after the length field
- size of the string we'll copy it into
Reported-by: Elman Shahbazov <shahbazovelman97@gmail.com>
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2026-08-14 14:43 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-14 14:43 [bluez/bluez] 61b2d3: avrcp: Fix Out-of-Bounds Read in AVRCP GetFolderIt hadess
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.