[PATCH BlueZ] pbap: Fix not checking Database Identifier length

["Frédéric Danis" <frederic.danis@collabora.com>]

Database Identifier is supposed to be 16 bytes values.

A paired Bluetooth device acting as a PBAP server can overflow the
heap in obexd by up to 239 bytes into adjacent allocations by returning
a DATABASEID_TAG application parameter with an oversized length.
With both length and content fully attacker-controlled, this enables
standard glibc heap exploitation primitives (tcache/fastbin poisoning)
leading to remote code execution in the obexd process.
---
 obexd/client/pbap.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/obexd/client/pbap.c b/obexd/client/pbap.c
index 0f575e61e..ce5e6cd5d 100644
--- a/obexd/client/pbap.c
+++ b/obexd/client/pbap.c
@@ -330,7 +330,8 @@ static void read_databaseid(struct pbap_data *pbap, GObexApparam *apparam)
 		data = value;
 	}
 
-	if (memcmp(data, pbap->databaseid, len)) {
+	if (len == sizeof(pbap->databaseid) &&
+			memcmp(data, pbap->databaseid, len)) {
 		memcpy(pbap->databaseid, data, len);
 		g_dbus_emit_property_changed(conn,
 					obc_session_get_path(pbap->session),
-- 
2.43.0