* [PATCH BlueZ] gatt: Fix potential buffer out-of-bound
@ 2021-01-04 18:41 Luiz Augusto von Dentz
2021-01-04 18:57 ` [BlueZ] " bluez.test.bot
0 siblings, 1 reply; 3+ messages in thread
From: Luiz Augusto von Dentz @ 2021-01-04 18:41 UTC (permalink / raw)
To: linux-bluetooth
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
When client features is read check if the offset is within the cli_feat
bounds.
Fixes: https://github.com/bluez/bluez/issues/70
---
src/gatt-database.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/src/gatt-database.c b/src/gatt-database.c
index 90cc4bade..f2d7b5821 100644
--- a/src/gatt-database.c
+++ b/src/gatt-database.c
@@ -1075,6 +1075,11 @@ static void cli_feat_read_cb(struct gatt_db_attribute *attrib,
goto done;
}
+ if (offset >= sizeof(state->cli_feat)) {
+ ecode = BT_ATT_ERROR_INVALID_OFFSET;
+ goto done;
+ }
+
len = sizeof(state->cli_feat) - offset;
value = len ? &state->cli_feat[offset] : NULL;
--
2.26.2
^ permalink raw reply related [flat|nested] 3+ messages in thread* RE: [BlueZ] gatt: Fix potential buffer out-of-bound
2021-01-04 18:41 [PATCH BlueZ] gatt: Fix potential buffer out-of-bound Luiz Augusto von Dentz
@ 2021-01-04 18:57 ` bluez.test.bot
2021-01-05 18:44 ` Luiz Augusto von Dentz
0 siblings, 1 reply; 3+ messages in thread
From: bluez.test.bot @ 2021-01-04 18:57 UTC (permalink / raw)
To: linux-bluetooth, luiz.dentz
[-- Attachment #1: Type: text/plain, Size: 557 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=408793
---Test result---
##############################
Test: CheckPatch - PASS
##############################
Test: CheckGitLint - PASS
##############################
Test: CheckBuild - PASS
##############################
Test: MakeCheck - PASS
---
Regards,
Linux Bluetooth
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [BlueZ] gatt: Fix potential buffer out-of-bound
2021-01-04 18:57 ` [BlueZ] " bluez.test.bot
@ 2021-01-05 18:44 ` Luiz Augusto von Dentz
0 siblings, 0 replies; 3+ messages in thread
From: Luiz Augusto von Dentz @ 2021-01-05 18:44 UTC (permalink / raw)
To: linux-bluetooth@vger.kernel.org
Hi,
On Mon, Jan 4, 2021 at 10:57 AM <bluez.test.bot@gmail.com> wrote:
>
> This is automated email and please do not reply to this email!
>
> Dear submitter,
>
> Thank you for submitting the patches to the linux bluetooth mailing list.
> This is a CI test results with your patch series:
> PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=408793
>
> ---Test result---
>
> ##############################
> Test: CheckPatch - PASS
>
> ##############################
> Test: CheckGitLint - PASS
>
> ##############################
> Test: CheckBuild - PASS
>
> ##############################
> Test: MakeCheck - PASS
>
>
>
> ---
> Regards,
> Linux Bluetooth
Pushed.
--
Luiz Augusto von Dentz
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-01-05 18:45 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-01-04 18:41 [PATCH BlueZ] gatt: Fix potential buffer out-of-bound Luiz Augusto von Dentz
2021-01-04 18:57 ` [BlueZ] " bluez.test.bot
2021-01-05 18:44 ` Luiz Augusto von Dentz
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox