[PATCH v2] sdp: Prevent integer underflow in string attribute length calculation

[Hui Peng <benquike@gmail.com>]

In lib/bluetooth/sdp.c, attribute string length calculations subtract
sizeof(uint8_t) from d->unitSize (e.g. d->unitSize - sizeof(uint8_t)).
When d->unitSize is 0 or less than sizeof(uint8_t), this subtraction
underflows in 32-bit integer arithmetic to a negative/huge length value,
passing invalid sizes to memory allocation and length extraction
functions.

Add explicit lower-bound guards checking d->unitSize > (int)sizeof(uint8_t)
to ensure that when d->unitSize <= sizeof(uint8_t), the calculated string
length is safely set to 0.

Assisted-by: Antigravity
---
Changes in v2:
- Cast sizeof(uint8_t) to (int) in comparison checks to fix
  -Werror=sign-compare compiler warnings reported by BlueZ CI.
- Refactor length calculation blocks to use clear if/else guards.

 lib/bluetooth/sdp.c | 24 ++++++++++++++++++------
 1 file changed, 18 insertions(+), 6 deletions(-)

diff --git a/lib/bluetooth/sdp.c b/lib/bluetooth/sdp.c
index 1e027f9..d31463b 100644
--- a/lib/bluetooth/sdp.c
+++ b/lib/bluetooth/sdp.c
@@ -730,7 +730,10 @@ static int sdp_get_data_size(sdp_buf_t *buf, sdp_data_t *d)
 	case SDP_URL_STR8:
 	case SDP_URL_STR16:
 	case SDP_URL_STR32:
-		data_size = d->unitSize - sizeof(uint8_t);
+		if (d->unitSize > (int)sizeof(uint8_t))
+			data_size = d->unitSize - sizeof(uint8_t);
+		else
+			data_size = 0;
 		break;
 	case SDP_SEQ8:
 	case SDP_SEQ16:
@@ -1523,8 +1526,12 @@ static void *sdp_data_value(sdp_data_t *data, uint32_t *len)
 	case SDP_URL_STR32:
 	case SDP_TEXT_STR32:
 		val = data->val.str;
-		if (len)
-			*len = data->unitSize - sizeof(uint8_t);
+		if (len) {
+			if (data->unitSize > (int)sizeof(uint8_t))
+				*len = data->unitSize - sizeof(uint8_t);
+			else
+				*len = 0;
+		}
 		break;
 	case SDP_ALT8:
 	case SDP_ALT16:
@@ -4852,7 +4859,11 @@ int sdp_set_supp_feat(sdp_record_t *rec, const sdp_list_t *sf)
 			case SDP_TEXT_STR8:
 			case SDP_TEXT_STR16:
 				vals[j] = data->val.str;
-				lengths[j] = data->unitSize - sizeof(uint8_t);
+				if (data->unitSize > (int)sizeof(uint8_t))
+					lengths[j] = data->unitSize -
+							sizeof(uint8_t);
+				else
+					lengths[j] = 0;
 				break;
 			case SDP_ALT8:
 			case SDP_ALT16:
@@ -4929,7 +4939,10 @@ int sdp_get_supp_feat(const sdp_record_t *rec, sdp_list_t **seqp)
 			case SDP_TEXT_STR8:
 			case SDP_TEXT_STR16:
 				val = dd->val.str;
-				length = dd->unitSize - sizeof(uint8_t);
+				if (dd->unitSize > (int)sizeof(uint8_t))
+					length = dd->unitSize - sizeof(uint8_t);
+				else
+					length = 0;
 				break;
 			case SDP_UINT8:
 			case SDP_UINT16:
-- 
2.47.3