[PATCH v2] sdp: Prevent integer underflow in string attribute length calculation

[PATCH v2] sdp: Prevent integer underflow in string attribute length calculation

[Hui Peng]

In lib/bluetooth/sdp.c, attribute string length calculations subtract
sizeof(uint8_t) from d->unitSize (e.g. d->unitSize - sizeof(uint8_t)).
When d->unitSize is 0 or less than sizeof(uint8_t), this subtraction
underflows in 32-bit integer arithmetic to a negative/huge length value,
passing invalid sizes to memory allocation and length extraction
functions.

Add explicit lower-bound guards checking d->unitSize > (int)sizeof(uint8_t)
to ensure that when d->unitSize <= sizeof(uint8_t), the calculated string
length is safely set to 0.

Assisted-by: Antigravity
---
Changes in v2:
- Cast sizeof(uint8_t) to (int) in comparison checks to fix
  -Werror=sign-compare compiler warnings reported by BlueZ CI.
- Refactor length calculation blocks to use clear if/else guards.

 lib/bluetooth/sdp.c | 24 ++++++++++++++++++------
 1 file changed, 18 insertions(+), 6 deletions(-)

diff --git a/lib/bluetooth/sdp.c b/lib/bluetooth/sdp.c
index 1e027f9..d31463b 100644
--- a/lib/bluetooth/sdp.c
+++ b/lib/bluetooth/sdp.c
@@ -730,7 +730,10 @@ static int sdp_get_data_size(sdp_buf_t *buf, sdp_data_t *d)
 	case SDP_URL_STR8:
 	case SDP_URL_STR16:
 	case SDP_URL_STR32:
-		data_size = d->unitSize - sizeof(uint8_t);
+		if (d->unitSize > (int)sizeof(uint8_t))
+			data_size = d->unitSize - sizeof(uint8_t);
+		else
+			data_size = 0;
 		break;
 	case SDP_SEQ8:
 	case SDP_SEQ16:
@@ -1523,8 +1526,12 @@ static void *sdp_data_value(sdp_data_t *data, uint32_t *len)
 	case SDP_URL_STR32:
 	case SDP_TEXT_STR32:
 		val = data->val.str;
-		if (len)
-			*len = data->unitSize - sizeof(uint8_t);
+		if (len) {
+			if (data->unitSize > (int)sizeof(uint8_t))
+				*len = data->unitSize - sizeof(uint8_t);
+			else
+				*len = 0;
+		}
 		break;
 	case SDP_ALT8:
 	case SDP_ALT16:
@@ -4852,7 +4859,11 @@ int sdp_set_supp_feat(sdp_record_t *rec, const sdp_list_t *sf)
 			case SDP_TEXT_STR8:
 			case SDP_TEXT_STR16:
 				vals[j] = data->val.str;
-				lengths[j] = data->unitSize - sizeof(uint8_t);
+				if (data->unitSize > (int)sizeof(uint8_t))
+					lengths[j] = data->unitSize -
+							sizeof(uint8_t);
+				else
+					lengths[j] = 0;
 				break;
 			case SDP_ALT8:
 			case SDP_ALT16:
@@ -4929,7 +4939,10 @@ int sdp_get_supp_feat(const sdp_record_t *rec, sdp_list_t **seqp)
 			case SDP_TEXT_STR8:
 			case SDP_TEXT_STR16:
 				val = dd->val.str;
-				length = dd->unitSize - sizeof(uint8_t);
+				if (dd->unitSize > (int)sizeof(uint8_t))
+					length = dd->unitSize - sizeof(uint8_t);
+				else
+					length = 0;
 				break;
 			case SDP_UINT8:
 			case SDP_UINT16:
-- 
2.47.3

RE: [v2] sdp: Prevent integer underflow in string attribute length calculation

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1021 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1181248/

---Test result---

Test Summary:
CheckPatch                    PASS      0.55 seconds
GitLint                       PASS      0.37 seconds
BuildEll                      PASS      19.72 seconds
BluezMake                     PASS      393.94 seconds
MakeCheck                     PASS      0.90 seconds
MakeDistcheck                 PASS      143.49 seconds
CheckValgrind                 PASS      146.23 seconds
CheckSmatch                   PASS      291.36 seconds
bluezmakeextell               PASS      96.12 seconds
TestFunctional                PASS      1156.46 seconds
IncrementalBuild              PASS      392.60 seconds
ScanBuild                     PASS      1150.89 seconds



https://github.com/bluez/bluez/pull/2635

---
Regards,
Linux Bluetooth

Re: [PATCH v2] sdp: Prevent integer underflow in string attribute length calculation

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Thu,  8 Oct 2026 04:27:20 +0000 you wrote:
> In lib/bluetooth/sdp.c, attribute string length calculations subtract
> sizeof(uint8_t) from d->unitSize (e.g. d->unitSize - sizeof(uint8_t)).
> When d->unitSize is 0 or less than sizeof(uint8_t), this subtraction
> underflows in 32-bit integer arithmetic to a negative/huge length value,
> passing invalid sizes to memory allocation and length extraction
> functions.
> 
> [...]

Here is the summary with links:
  - [v2] sdp: Prevent integer underflow in string attribute length calculation
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=1baa0a2aef3b

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html