Linux bluetooth development
 help / color / mirror / Atom feed
From: Bastien Nocera <hadess@hadess.net>
To: linux-bluetooth@vger.kernel.org
Subject: [BlueZ, v4 5/9] unit: Add test for sdp-xml duplicate attribute bug
Date: Wed, 12 Aug 2026 10:01:36 +0200	[thread overview]
Message-ID: <20260812080410.2116906-6-hadess@hadess.net> (raw)
In-Reply-To: <20260812080410.2116906-1-hadess@hadess.net>

See https://github.com/bluez/bluez/security/advisories/GHSA-75v6-6q44-57hc

Co-authored-by: Aisle Research
---
 Makefile.am                          | 1 +
 unit/sdp-xml/duplicate-attribute.xml | 4 ++++
 unit/test-sdp-xml.c                  | 2 ++
 3 files changed, 7 insertions(+)
 create mode 100644 unit/sdp-xml/duplicate-attribute.xml

diff --git a/Makefile.am b/Makefile.am
index 1d5f02b0d362..3c6cf92ab403 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -649,6 +649,7 @@ unit_test_sdp_xml_CPPFLAGS = -I$(srcdir)/lib
 
 EXTRA_DIST += unit/sdp-xml/Bluetooth_HID-sdp_record.xml		\
 	unit/sdp-xml/compute-seq-size-type-confusion.xml	\
+	unit/sdp-xml/duplicate-attribute.xml			\
 	unit/sdp-xml/qt-SerialPortSDPRecord.xml
 
 unit_tests += unit/test-avdtp
diff --git a/unit/sdp-xml/duplicate-attribute.xml b/unit/sdp-xml/duplicate-attribute.xml
new file mode 100644
index 000000000000..a30bc59d94ff
--- /dev/null
+++ b/unit/sdp-xml/duplicate-attribute.xml
@@ -0,0 +1,4 @@
+<record>
+<attribute id="0x0001"><text value="A"/></attribute>
+<attribute id="0x0001"><text value="B"/></attribute>
+</record>
diff --git a/unit/test-sdp-xml.c b/unit/test-sdp-xml.c
index c8288ca10b8b..9bf35235423b 100644
--- a/unit/test-sdp-xml.c
+++ b/unit/test-sdp-xml.c
@@ -82,6 +82,8 @@ int main(int argc, char *argv[])
 	DEFINE_TEST("qt-SerialPortSDPRecord.xml", TRUE);
 	/* From https://github.com/bluez/bluez/security/advisories/GHSA-7mmr-gwqx-vc34 */
 	DEFINE_TEST("compute-seq-size-type-confusion.xml", FALSE);
+	/* From https://github.com/bluez/bluez/security/advisories/GHSA-75v6-6q44-57hc */
+	DEFINE_TEST("duplicate-attribute.xml", TRUE);
 
 	return tester_run();
 }
-- 
2.55.0


  parent reply	other threads:[~2026-08-12  8:04 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-08-12  8:01 [BlueZ, v4 0/9] 3 SDP XML security fixes Bastien Nocera
2026-08-12  8:01 ` [BlueZ, v4 1/9] unit: Add test for sdp_xml_parse_record() Bastien Nocera
2026-08-12  9:45   ` 3 SDP XML security fixes bluez.test.bot
2026-08-12  8:01 ` [BlueZ, v4 2/9] sdp-xml: Fix crash caused by type confusion when parsing crafted SDP XML Bastien Nocera
2026-08-12  8:01 ` [BlueZ, v4 3/9] unit: Add test for sdp-xml type-confusion bug Bastien Nocera
2026-08-12  8:01 ` [BlueZ, v4 4/9] sdp-xml: Fix memory leak when adding duplicate attributes Bastien Nocera
2026-08-12  8:01 ` Bastien Nocera [this message]
2026-08-12  8:01 ` [BlueZ, v4 6/9] sdp-xml: Optimise parsing large sequences Bastien Nocera
2026-08-12  8:01 ` [BlueZ, v4 7/9] unit: Add test for slow element_end() append Bastien Nocera
2026-08-12  8:01 ` [BlueZ, v4 8/9] sdp-xml: Fix stack overflow when converting large sequences to XML Bastien Nocera
2026-08-12  8:01 ` [BlueZ, v4 9/9] unit: Add convert_sdp_record_to_xml() to SDP XML testing Bastien Nocera

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260812080410.2116906-6-hadess@hadess.net \
    --to=hadess@hadess.net \
    --cc=linux-bluetooth@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox