[bluez/bluez] e829f2: bass: Fix heap buffer overflow allocating subgroup...

[bluez/bluez] e829f2: bass: Fix heap buffer overflow allocating subgroup...

[hadess]

  Branch: refs/heads/1152688
  Home:   https://github.com/bluez/bluez
  Commit: e829f2acc601a8b8ac917957c06c175d38b79c27
      https://github.com/bluez/bluez/commit/e829f2acc601a8b8ac917957c06c175d38b79c27
  Author: Bastien Nocera <hadess@hadess.net>
  Date:   2026-08-27 (Thu, 27 Aug 2026)

  Changed paths:
    M src/shared/bass.c

  Log Message:
  -----------
  bass: Fix heap buffer overflow allocating subgroup_data array

bass_build_bcast_src() in src/shared/bass.c parses the Broadcast Receive State
characteristic value received from a remote BASS server.

It reads an attacker-controlled num_subgroups byte (range 0-255) but always
allocates a single bt_bass_subgroup_data entry (24 bytes):
subgroup_data = new0(struct bt_bass_subgroup_data, 1);   // line 337: always 1
for (int i = 0; i < num_subgroups; i++) {                // line 343: up to 255
    subgroup_data[i].bis_sync = bis_sync_state;          // line 355: OOB write

Reported-by: @thaidn and @bronson-calif of Calif.io in collaboration
 with Claude and Anthropic Research
Suggested-by: @trace37labs for the Fixes

Fixes: 8980f4f1f7 ("shared/bass: Functions cleanup")

See: https://github.com/bluez/bluez/security/advisories/GHSA-7wjj-8mrm-jhw4



To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications