* [PATCH BlueZ] monitor: Validate HCI event/command parameter length when parsing
@ 2014-03-01 19:23 Anderson Lizardo
2014-03-02 16:39 ` Johan Hedberg
0 siblings, 1 reply; 2+ messages in thread
From: Anderson Lizardo @ 2014-03-01 19:23 UTC (permalink / raw)
To: linux-bluetooth; +Cc: Anderson Lizardo
Print an error message if the parameter length for HCI commands/events
does not match the actual remaining packet size.
This mainly avoids using garbage bytes when parsing corrupted packets.
The check was inspired on those used when parsing SCO/ACL packets.
---
monitor/packet.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/monitor/packet.c b/monitor/packet.c
index 78ecfd7..58a75db 100644
--- a/monitor/packet.c
+++ b/monitor/packet.c
@@ -7533,6 +7533,13 @@ void packet_hci_command(struct timeval *tv, uint16_t index,
return;
}
+ if (size != hdr->plen) {
+ print_text(COLOR_ERROR, "invalid packet size (%d != %d)", size,
+ hdr->plen);
+ packet_hexdump(data, size);
+ return;
+ }
+
if (opcode_data->cmd_fixed) {
if (hdr->plen != opcode_data->cmd_size) {
print_text(COLOR_ERROR, "invalid packet size");
@@ -7598,6 +7605,13 @@ void packet_hci_event(struct timeval *tv, uint16_t index,
return;
}
+ if (size != hdr->plen) {
+ print_text(COLOR_ERROR, "invalid packet size (%d != %d)", size,
+ hdr->plen);
+ packet_hexdump(data, size);
+ return;
+ }
+
if (event_data->fixed) {
if (hdr->plen != event_data->size) {
print_text(COLOR_ERROR, "invalid packet size");
--
1.8.3.2
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH BlueZ] monitor: Validate HCI event/command parameter length when parsing
2014-03-01 19:23 [PATCH BlueZ] monitor: Validate HCI event/command parameter length when parsing Anderson Lizardo
@ 2014-03-02 16:39 ` Johan Hedberg
0 siblings, 0 replies; 2+ messages in thread
From: Johan Hedberg @ 2014-03-02 16:39 UTC (permalink / raw)
To: Anderson Lizardo; +Cc: linux-bluetooth
Hi Lizardo,
On Sat, Mar 01, 2014, Anderson Lizardo wrote:
> Print an error message if the parameter length for HCI commands/events
> does not match the actual remaining packet size.
>
> This mainly avoids using garbage bytes when parsing corrupted packets.
> The check was inspired on those used when parsing SCO/ACL packets.
> ---
> monitor/packet.c | 14 ++++++++++++++
> 1 file changed, 14 insertions(+)
Applied. Thanks.
Johan
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2014-03-02 16:39 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-03-01 19:23 [PATCH BlueZ] monitor: Validate HCI event/command parameter length when parsing Anderson Lizardo
2014-03-02 16:39 ` Johan Hedberg
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).