Linux bluetooth development
 help / color / mirror / Atom feed
From: Bastien Nocera <hadess@hadess.net>
To: linux-bluetooth@vger.kernel.org
Subject: [BlueZ, v3 7/9] unit: Add test for slow element_end() append
Date: Tue, 11 Aug 2026 16:54:10 +0200	[thread overview]
Message-ID: <20260811145704.1766949-8-hadess@hadess.net> (raw)
In-Reply-To: <20260811145704.1766949-1-hadess@hadess.net>

This uses 40k iterations as this takes a visible amount of time on a
pretty fast desktop machine (3-4 secs on an i9 9900k).

See: https://github.com/bluez/bluez/security/advisories/GHSA-4p57-mrcv-r2jc
---
 unit/test-sdp-xml.c | 45 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)

diff --git a/unit/test-sdp-xml.c b/unit/test-sdp-xml.c
index 2794170dc153..0a4f9b0d3992 100644
--- a/unit/test-sdp-xml.c
+++ b/unit/test-sdp-xml.c
@@ -64,6 +64,46 @@ static void parse_xml_for_filename(gconstpointer data)
 	g_free(path);
 }
 
+#define XML_START								\
+	"<?xml version=\"1.0\" encoding=\"UTF-8\" ?>\n"				\
+	"<record>\n"								\
+	"	<attribute id=\"0x0004\">\n"					\
+	"		<sequence>"
+
+#define XML_VALUE								\
+	"			<uint8 value=\"0x01\" />\n"
+
+#define XML_END									\
+	"		</sequence>\n"						\
+	"	</attribute>\n"							\
+	"</record>"
+
+static void sequence_on_squared(gconstpointer data)
+{
+	struct test_data *t = (struct test_data *) data;
+	parse_xml(t->s->str, t->s->len, TRUE);
+}
+
+static void sequence_on_squared_setup(gconstpointer data)
+{
+	struct test_data *t = (struct test_data *) data;
+	guint i;
+
+	t->s = g_string_new(XML_START);
+	for (i = 0; i < 40000; i++)
+		t->s = g_string_append(t->s, XML_VALUE);
+	t->s = g_string_append(t->s, XML_END);
+
+	tester_setup_complete();
+}
+
+static void sequence_on_squared_teardown(gconstpointer data)
+{
+	struct test_data *t = (struct test_data *) data;
+	g_string_free(t->s, TRUE);
+	tester_teardown_complete();
+}
+
 #define DEFINE_TEST(fname, res)							\
 	data.expected_result = res;						\
 	data.filename = fname;							\
@@ -82,5 +122,10 @@ int main(int argc, char *argv[])
 	/* From https://github.com/bluez/bluez/security/advisories/GHSA-75v6-6q44-57hc */
 	DEFINE_TEST("duplicate-attribute.xml", TRUE);
 
+	tester_add("/sequence_on_squared", &data,
+		   sequence_on_squared_setup,
+		   sequence_on_squared,
+		   sequence_on_squared_teardown);
+
 	return tester_run();
 }
-- 
2.55.0


  parent reply	other threads:[~2026-08-11 15:10 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-08-11 14:54 [BlueZ, v3 0/9] 3 SDP XML security fixes Bastien Nocera
2026-08-11 14:54 ` [BlueZ, v3 1/9] unit: Add test for sdp_xml_parse_record() Bastien Nocera
2026-08-11 16:33   ` 3 SDP XML security fixes bluez.test.bot
2026-08-11 14:54 ` [BlueZ, v3 2/9] sdp-xml: Fix crash caused by type confusion when parsing crafted SDP XML Bastien Nocera
2026-08-11 14:54 ` [BlueZ, v3 3/9] unit: Add test for sdp-xml type-confusion bug Bastien Nocera
2026-08-11 14:54 ` [BlueZ, v3 4/9] sdp-xml: Fix memory leak when adding duplicate attributes Bastien Nocera
2026-08-11 14:54 ` [BlueZ, v3 5/9] unit: Add test for sdp-xml duplicate attribute bug Bastien Nocera
2026-08-11 14:54 ` [BlueZ, v3 6/9] sdp-xml: Optimise parsing large sequences Bastien Nocera
2026-08-11 14:54 ` Bastien Nocera [this message]
2026-08-11 14:54 ` [BlueZ, v3 8/9] sdp-xml: Fix stack overflow when converting large sequences to XML Bastien Nocera
2026-08-11 14:54 ` [BlueZ, v3 9/9] unit: Add convert_sdp_record_to_xml() to SDP XML testing Bastien Nocera

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260811145704.1766949-8-hadess@hadess.net \
    --to=hadess@hadess.net \
    --cc=linux-bluetooth@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox