RE: Fix Out-of-Bounds Read in AVRCP GetFolderItems parsing

RE: Fix Out-of-Bounds Read in AVRCP GetFolderItems parsing

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 382 bytes --]

This is an automated email and please do not reply to this email.

Dear Submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
While preparing the CI tests, the patches you submitted couldn't be applied to the current HEAD of the repository.

----- Output -----


Please resolve the issue and submit the patches again.


---
Regards,
Linux Bluetooth

[PATCH] Fix Out-of-Bounds Read in AVRCP GetFolderItems parsing

[Elman Shahbazov]

Signed-off-by: Elman Shahbazov <shahbazovelman97@gmail.com>
---
 profiles/audio/avrcp.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/profiles/audio/avrcp.c b/profiles/audio/avrcp.c
index 2194a9135..19ea13c16 100644
--- a/profiles/audio/avrcp.c
+++ b/profiles/audio/avrcp.c
@@ -2625,8 +2625,12 @@ static struct media_item *parse_media_element(struct avrcp *session,
 	uid = get_be64(&operands[0]);
 
 	memset(name, 0, sizeof(name));
-	namesize = get_be16(&operands[11]);
+	namesize = MIN(get_be16(&operands[11]), len - 13);
 	namelen = MIN(namesize, sizeof(name) - 1);
+
+	if (len < 13 + namesize)
+		return NULL;
+
 	if (namelen > 0) {
 		memcpy(name, &operands[13], namelen);
 		strtoutf8(name, namelen);
@@ -2669,7 +2673,8 @@ static struct media_item *parse_media_folder(struct avrcp *session,
 	playable = operands[9];
 
 	memset(name, 0, sizeof(name));
-	namelen = MIN(get_be16(&operands[12]), sizeof(name) - 1);
+	namelen = MIN(get_be16(&operands[12]), len - 14);
+	namelen = MIN(namelen, sizeof(name) - 1);
 	if (namelen > 0)
 		memcpy(name, &operands[14], namelen);
 
-- 
2.53.0

RE: Fix Out-of-Bounds Read in AVRCP GetFolderItems parsing

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 987 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1138845

---Test result---

Test Summary:
CheckPatch                    PASS      0.31 seconds
GitLint                       PASS      0.27 seconds
BuildEll                      PASS      15.68 seconds
BluezMake                     PASS      396.13 seconds
MakeCheck                     PASS      4.22 seconds
MakeDistcheck                 PASS      124.49 seconds
CheckValgrind                 PASS      121.27 seconds
CheckSmatch                   PASS      211.57 seconds
bluezmakeextell               PASS      75.56 seconds
IncrementalBuild              PASS      393.03 seconds
ScanBuild                     PASS      659.48 seconds



https://github.com/bluez/bluez/pull/2368

---
Regards,
Linux Bluetooth