From: "github-actions[bot]" <noreply@github.com>
To: linux-bluetooth@vger.kernel.org
Subject: [bluez/bluez] 476cbe: monitor: Fix stack-buffer-overflow in packet_hci_s...
Date: Thu, 24 Sep 2026 07:24:38 -0700 [thread overview]
Message-ID: <bluez/bluez/push/refs/heads/1173024/000000-476cbe@github.com> (raw)
Branch: refs/heads/1173024
Home: https://github.com/bluez/bluez
Commit: 476cbe9a5a86f0763addd45d0a17b52dfc2af874
https://github.com/bluez/bluez/commit/476cbe9a5a86f0763addd45d0a17b52dfc2af874
Author: Zijun Hu <zijun.hu@oss.qualcomm.com>
Date: 2026-09-24 (Thu, 24 Sep 2026)
Changed paths:
M monitor/packet.c
Log Message:
-----------
monitor: Fix stack-buffer-overflow in packet_hci_scodata()
Fix below handle_str[] OOB by:
- Increase buffer size.
- Use snprintf() instead of sprintf().
Also access SCO header fields after validating header size.
AddressSanitizer: stack-buffer-overflow on address 0x7bd1443dedba at pc 0x7bd1474ced69 bp 0x7ffdb0324880 sp 0x7ffdb0324010
WRITE of size 40 at 0x7bd1443dedba thread T0
#0 0x7bd1474ced68 in vsprintf ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:1671
#1 0x7bd1474d0643 in __sprintf_chk ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:1719
#2 0x5f5c39d02ea7 in sprintf /usr/include/x86_64-linux-gnu/bits/stdio2.h:30
#3 0x5f5c39d02ea7 in handle_str_append_addr ../monitor/packet.c:14995
#4 0x5f5c39d58f19 in packet_hci_scodata ../monitor/packet.c:15125
#5 0x5f5c39d5eaf9 in packet_monitor ../monitor/packet.c:4841
#6 0x5f5c39cc4094 in data_callback ../monitor/control.c:991
#7 0x5f5c39e7fa7d in mainloop_run ../src/shared/mainloop.c:104
#8 0x7bd1474e81d86 in mainloop_run_with_signal ../src/shared/mainloop-notify.c:196
#9 0x5f5c39cbbb4c in main ../monitor/main.c:315
#10 0x7bd14662a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#11 0x7bd14662a28a in __libc_start_main_impl ../sysdeps/nptl/libc-start.c:360
#12 0x5f5c39cbc664 in _start (/usr/bin/btmon+0x2b2664) (BuildId: 370a6386c9fceae18f9a456c0c029ac378b0b070)
Fixes: 611f84a0ff0e ("monitor: Annotate ACL/SCO/ISO data with device address")
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
reply other threads:[~2026-09-24 14:24 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=bluez/bluez/push/refs/heads/1173024/000000-476cbe@github.com \
--to=noreply@github.com \
--cc=linux-bluetooth@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.