From: Oliver Chang <noreply@github.com>
To: linux-bluetooth@vger.kernel.org
Subject: [bluez/bluez] 4eead4: Fixed heap-buffer-overflow in `compute_seq_size`.
Date: Sat, 09 Aug 2025 23:57:16 -0700 [thread overview]
Message-ID: <bluez/bluez/push/refs/heads/989673/000000-4eead4@github.com> (raw)
Branch: refs/heads/989673
Home: https://github.com/bluez/bluez
Commit: 4eead430b267e1a06792cc9fa90d91a7b7ef75c1
https://github.com/bluez/bluez/commit/4eead430b267e1a06792cc9fa90d91a7b7ef75c1
Author: Oliver Chang <ochang@google.com>
Date: 2025-08-10 (Sun, 10 Aug 2025)
Changed paths:
M src/sdp-xml.c
Log Message:
-----------
Fixed heap-buffer-overflow in `compute_seq_size`.
By adding checks for sequence/alternate types in element_end to avoid a
type confusion.
This issue was found by OSS-Fuzz.
This can be triggered by using an input of
`<sequence><foo/><text/></sequence>` against the harness in
https://github.com/google/oss-fuzz/blob/master/projects/bluez/fuzz_xml.c
https://issues.oss-fuzz.com/issues/42516062
https://oss-fuzz.com/testcase-detail/5896441415729152
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
reply other threads:[~2025-08-10 6:57 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=bluez/bluez/push/refs/heads/989673/000000-4eead4@github.com \
--to=noreply@github.com \
--cc=linux-bluetooth@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.