From: Oliver Chang <ochang@google.com>
To: linux-bluetooth@vger.kernel.org
Cc: oss-fuzz-bugs@google.com, Oliver Chang <ochang@google.com>
Subject: [PATCH BlueZ 0/1] Fix buffer overflow in sdp_xml_parse_uuid128
Date: Sun, 10 Aug 2025 07:30:08 +0000 [thread overview]
Message-ID: <20250810073008.1824799-2-ochang@google.com> (raw)
This fixes a buffer overflow found by OSS-Fuzz. The ASan stacktrace for
this is:
```
=================================================================
==402==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7c960dd00030 at pc 0x59331ced5b8d bp 0x7fffedcc0c50 sp 0x7fffedcc0c48
WRITE of size 1 at 0x7c960dd00030 thread T0
#0 0x59331ced5b8c in sdp_xml_parse_uuid128 bluez/src/sdp-xml.c:128:17
#1 0x59331ced5b8c in sdp_xml_parse_uuid bluez/src/sdp-xml.c:146:9
#2 0x59331ced3529 in sdp_xml_parse_datatype bluez/src/sdp-xml.c:428:10
#3 0x59331ced3529 in element_start bluez/src/sdp-xml.c:498:32
#4 0x59331cf26628 in emit_start_element glib/glib/gmarkup.c:1010:5
#5 0x59331cf258d7 in g_markup_parse_context_parse glib/glib/gmarkup.c:1369:17
#6 0x59331ced1969 in sdp_xml_parse_record bluez/src/sdp-xml.c:621:6
#7 0x59331ced8cc9 in LLVMFuzzerTestOneInput /src/fuzz_xml.c:30:9
#8 0x59331ced1879 in ExecuteFilesOnyByOne /src/aflplusplus/utils/aflpp_driver/aflpp_driver.c:255:7
#9 0x59331ced1675 in LLVMFuzzerRunDriver /src/aflplusplus/utils/aflpp_driver/aflpp_driver.c:0
#10 0x59331ced122d in main /src/aflplusplus/utils/aflpp_driver/aflpp_driver.c:311:10
#11 0x7c961015c082 in __libc_start_main /build/glibc-LcI20x/glibc-2.31/csu/libc-start.c:308:16
#12 0x59331cdf8a2d in _start
```
Oliver Chang (1):
Fix buffer overflow in sdp_xml_parse_uuid128
src/sdp-xml.c | 6 ++++++
1 file changed, 6 insertions(+)
--
2.50.1.703.g449372360f-goog
next reply other threads:[~2025-08-10 7:30 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-08-10 7:30 Oliver Chang [this message]
2025-08-10 7:30 ` [PATCH BlueZ 1/1] Fix buffer overflow in sdp_xml_parse_uuid128 Oliver Chang
2025-08-10 8:51 ` bluez.test.bot
2025-08-11 20:40 ` [PATCH BlueZ 0/1] " patchwork-bot+bluetooth
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250810073008.1824799-2-ochang@google.com \
--to=ochang@google.com \
--cc=linux-bluetooth@vger.kernel.org \
--cc=oss-fuzz-bugs@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox