* [PATCH BlueZ] tools/hcidump: fix a out-of-bounds read in le_meta_ev_dump()
@ 2020-08-30 13:07 zefang han
0 siblings, 0 replies; only message in thread
From: zefang han @ 2020-08-30 13:07 UTC (permalink / raw)
To: linux-bluetooth
Check whether the subevent code of le meta event is bigger than
the size of ev_le_meta_str.
---
tools/parser/hci.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/tools/parser/hci.c b/tools/parser/hci.c
index 41f6fe087..acd41be83 100644
--- a/tools/parser/hci.c
+++ b/tools/parser/hci.c
@@ -3668,7 +3668,12 @@ static inline void le_meta_ev_dump(int level, struct frame *frm)
frm->len -= EVT_LE_META_EVENT_SIZE;
p_indent(level, frm);
- printf("%s\n", ev_le_meta_str[subevent]);
+
+ if (subevent > LE_EV_NUM) {
+ printf("Unknown\n");
+ } else {
+ printf("%s\n", ev_le_meta_str[subevent]);
+ }
switch (mevt->subevent) {
case EVT_LE_CONN_COMPLETE:
--
2.17.1
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2020-08-30 13:07 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-08-30 13:07 [PATCH BlueZ] tools/hcidump: fix a out-of-bounds read in le_meta_ev_dump() zefang han
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).