Re: [PATCH] Bluetooth: hci_codec: validate vendor codec count length

[Laxman Acharya Padhya <acharyalaxman8848@gmail.com>]

Hi Luiz,

You are right that sizeof(*vnd_codecs) and
sizeof(vnd_codecs->num) are both one byte here.  The issue is the order
in which the existing check performs the access: vnd_codecs->num must
be evaluated as the count argument to flex_array_size() before the
result can be compared with skb->len.

For example, consider a V1 reply containing exactly these three bytes:

	status = 0, std_codecs->num = 1, std_codecs->codec[0]

It passes the initial sizeof(*rp) check.  After pulling the status byte,
the standard codec length check also passes, and pulling that array
leaves skb->len equal to zero.  The existing vendor length check then
evaluates vnd_codecs->num with vnd_codecs pointing at the end of the
skb data.

The added check uses sizeof(), whose operand is not evaluated, to make
sure the count byte is present before the following expression reads
vnd_codecs->num.  The V2 parser has the same ordering issue.

Thanks,
Laxman