* [BlueZ 1/2] adv_monitor: Fix buffer overflow caused by integer overflow
2026-08-13 9:16 [BlueZ 0/2] adv_monitor: Fix buffer overflow caused by integer overflow Bastien Nocera
@ 2026-08-13 9:16 ` Bastien Nocera
2026-08-13 10:30 ` bluez.test.bot
2026-08-13 9:16 ` [BlueZ 2/2] adv_monitor: Ignore additional patterns past what's supported Bastien Nocera
1 sibling, 1 reply; 4+ messages in thread
From: Bastien Nocera @ 2026-08-13 9:16 UTC (permalink / raw)
To: linux-bluetooth
In src/adv_monitor.c, merged_pattern_send_add_pattern(), and with a
large merged_pattern->patterns list, it's possible to overflow cp_len,
an 8-bit integer:
pattern_count = queue_length(merged_pattern->patterns);
cp_len = sizeof(*cp) + pattern_count * sizeof(struct mgmt_adv_pattern);
Eight patterns require 273 bytes of command storage, but assigning
that result to uint8_t cp_len wraps it to 17 before allocation.
The loop that follows does not use the truncated size; it still copies
all eight 34-byte struct mgmt_adv_pattern records into the heap object.
The mismatch between the wrapped allocation size and the full copy
volume produces a large, deterministic heap overwrite.
Fix this in 2 ways in the function itself:
1) increase the size of cp_len, as 8 patterns would overflow it, and some
typical Bluetooth devices can support 16 patterns
2) Store the result of the multiplication in a 64-bit integer before
checking whether it's bigger than our 16-bit cp_len
A similar bug exists in merged_pattern_send_add_pattern_rssi().
Reported-by: @ax-nnlabs (for merged_pattern_send_add_pattern())
Reported-by: Aisle Research (for merged_pattern_send_add_pattern_rssi())
---
src/adv_monitor.c | 20 ++++++++++++++------
1 file changed, 14 insertions(+), 6 deletions(-)
diff --git a/src/adv_monitor.c b/src/adv_monitor.c
index 87fa824b35d8..7f437a0e7c8f 100644
--- a/src/adv_monitor.c
+++ b/src/adv_monitor.c
@@ -1106,12 +1106,15 @@ static bool merged_pattern_send_add_pattern(
struct adv_monitor_merged_pattern *merged_pattern)
{
struct mgmt_cp_add_adv_monitor *cp = NULL;
- uint8_t pattern_count, cp_len;
+ uint64_t cp_len;
+ uint8_t pattern_count;
const struct queue_entry *e;
bool success = true;
pattern_count = queue_length(merged_pattern->patterns);
cp_len = sizeof(*cp) + pattern_count * sizeof(struct mgmt_adv_pattern);
+ if (cp_len > UINT16_MAX)
+ return false;
cp = malloc0(cp_len);
if (!cp)
@@ -1126,8 +1129,9 @@ static bool merged_pattern_send_add_pattern(
if (!mgmt_send(merged_pattern->manager->mgmt,
MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
- merged_pattern->manager->adapter_id, cp_len, cp,
- add_adv_patterns_monitor_cb, merged_pattern, NULL)) {
+ merged_pattern->manager->adapter_id, (uint16_t) cp_len,
+ cp, add_adv_patterns_monitor_cb, merged_pattern,
+ NULL)) {
error("Unable to send Add Adv Patterns Monitor command");
success = false;
}
@@ -1141,12 +1145,15 @@ static bool merged_pattern_send_add_pattern_rssi(
struct adv_monitor_merged_pattern *merged_pattern)
{
struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = NULL;
- uint8_t pattern_count, cp_len;
+ uint64_t cp_len;
+ uint8_t pattern_count;
const struct queue_entry *e;
bool success = true;
pattern_count = queue_length(merged_pattern->patterns);
cp_len = sizeof(*cp) + pattern_count * sizeof(struct mgmt_adv_pattern);
+ if (cp_len > UINT16_MAX)
+ return false;
cp = malloc0(cp_len);
if (!cp)
@@ -1169,8 +1176,9 @@ static bool merged_pattern_send_add_pattern_rssi(
if (!mgmt_send(merged_pattern->manager->mgmt,
MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI,
- merged_pattern->manager->adapter_id, cp_len, cp,
- add_adv_patterns_monitor_cb, merged_pattern, NULL)) {
+ merged_pattern->manager->adapter_id, (uint16_t) cp_len,
+ cp, add_adv_patterns_monitor_cb, merged_pattern,
+ NULL)) {
error("Unable to send Add Adv Patterns Monitor RSSI command");
success = false;
}
--
2.55.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* [BlueZ 2/2] adv_monitor: Ignore additional patterns past what's supported
2026-08-13 9:16 [BlueZ 0/2] adv_monitor: Fix buffer overflow caused by integer overflow Bastien Nocera
2026-08-13 9:16 ` [BlueZ 1/2] " Bastien Nocera
@ 2026-08-13 9:16 ` Bastien Nocera
1 sibling, 0 replies; 4+ messages in thread
From: Bastien Nocera @ 2026-08-13 9:16 UTC (permalink / raw)
To: linux-bluetooth
Ignore patterns beyond what the adapter supports.
Suggested-by: Aisle Research
---
src/adv_monitor.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/src/adv_monitor.c b/src/adv_monitor.c
index 7f437a0e7c8f..c7de01f72a26 100644
--- a/src/adv_monitor.c
+++ b/src/adv_monitor.c
@@ -889,6 +889,7 @@ static bool parse_patterns(struct adv_monitor *monitor, const char *path)
{
DBusMessageIter array, array_iter;
uint16_t adapter_id = monitor->app->manager->adapter_id;
+ uint8_t max_num_patterns = monitor->app->manager->max_num_patterns;
if (!g_dbus_proxy_get_property(monitor->proxy, "Patterns", &array)) {
btd_error(adapter_id,
@@ -950,6 +951,10 @@ static bool parse_patterns(struct adv_monitor *monitor, const char *path)
queue_push_tail(monitor->merged_pattern->patterns, pattern);
+ if (queue_length(monitor->merged_pattern->patterns) >=
+ max_num_patterns)
+ break;
+
dbus_message_iter_next(&array_iter);
}
--
2.55.0
^ permalink raw reply related [flat|nested] 4+ messages in thread