* [PATCH BlueZ] gatt-server: Fix integer overflow @ 2026-07-23 8:42 zuohsh 2026-08-21 3:31 ` [PATCH v2] " zuohsh 0 siblings, 1 reply; 7+ messages in thread From: zuohsh @ 2026-07-23 8:42 UTC (permalink / raw) To: linux-bluetooth; +Cc: zuohsh By using size_t for realloc len and rejecting allocations exceeding UINT16_MAX , to prevent truncation into the uint16_t field. --- src/shared/gatt-server.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/src/shared/gatt-server.c b/src/shared/gatt-server.c index 709a8f94b..328755566 100644 --- a/src/shared/gatt-server.c +++ b/src/shared/gatt-server.c @@ -1174,12 +1174,12 @@ static bool append_prep_data(struct prep_write_data *prep_data, uint16_t handle, uint16_t length, uint8_t *value) { uint8_t *val; - uint16_t len; + size_t len; if (!length) return true; - len = prep_data->length + length; + len = (size_t)prep_data->length + (size_t)length; val = realloc(prep_data->value, len); if (!val) @@ -1188,7 +1188,11 @@ static bool append_prep_data(struct prep_write_data *prep_data, uint16_t handle, memcpy(val + prep_data->length, value, length); prep_data->value = val; - prep_data->length = len; + + if (len > UINT16_MAX) { + return false; + } + prep_data->length = (uint16_t)len; return true; } -- 2.43.0 ^ permalink raw reply related [flat|nested] 7+ messages in thread
* [PATCH v2] gatt-server: Fix integer overflow 2026-07-23 8:42 [PATCH BlueZ] gatt-server: Fix integer overflow zuohsh @ 2026-08-21 3:31 ` zuohsh 2026-08-21 4:46 ` [v2] " bluez.test.bot 0 siblings, 1 reply; 7+ messages in thread From: zuohsh @ 2026-08-21 3:31 UTC (permalink / raw) To: linux-bluetooth; +Cc: zuohsh By using size_t for realloc len and rejecting allocations exceeding UINT16_MAX , to prevent truncation into the uint16_t field. --- src/shared/gatt-server.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/src/shared/gatt-server.c b/src/shared/gatt-server.c index 709a8f94b..1ec826a69 100644 --- a/src/shared/gatt-server.c +++ b/src/shared/gatt-server.c @@ -1174,12 +1174,12 @@ static bool append_prep_data(struct prep_write_data *prep_data, uint16_t handle, uint16_t length, uint8_t *value) { uint8_t *val; - uint16_t len; + size_t len; if (!length) return true; - len = prep_data->length + length; + len = (size_t)prep_data->length + (size_t)length; val = realloc(prep_data->value, len); if (!val) @@ -1188,7 +1188,10 @@ static bool append_prep_data(struct prep_write_data *prep_data, uint16_t handle, memcpy(val + prep_data->length, value, length); prep_data->value = val; - prep_data->length = len; + + if (len > UINT16_MAX) + return false; + prep_data->length = (uint16_t)len; return true; } -- 2.43.0 Handle the CheckPatch failure reported by BluezTestBot. ^ permalink raw reply related [flat|nested] 7+ messages in thread
* RE: [v2] gatt-server: Fix integer overflow 2026-08-21 3:31 ` [PATCH v2] " zuohsh @ 2026-08-21 4:46 ` bluez.test.bot 2026-08-21 7:35 ` [PATCH v3] gatt-server: Fix integer overflow and 3 CI VLA wanings zuohsh 0 siblings, 1 reply; 7+ messages in thread From: bluez.test.bot @ 2026-08-21 4:46 UTC (permalink / raw) To: linux-bluetooth, zuohongsheng [-- Attachment #1: Type: text/plain, Size: 1745 bytes --] This is automated email and please do not reply to this email! Dear submitter, Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series: PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1149440 ---Test result--- Test Summary: CheckPatch PASS 0.40 seconds GitLint PASS 0.31 seconds BuildEll PASS 16.56 seconds BluezMake PASS 467.83 seconds MakeCheck PASS 0.87 seconds MakeDistcheck PASS 125.66 seconds CheckValgrind PASS 120.13 seconds CheckSmatch WARNING 234.02 seconds bluezmakeextell PASS 76.32 seconds IncrementalBuild PASS 495.77 seconds ScanBuild PASS 704.75 seconds Details ############################## Test: CheckSmatch - WARNING Desc: Run smatch tool with source Output: src/shared/gatt-server.c:271:25: warning: Variable length array is used.src/shared/gatt-server.c:614:25: warning: Variable length array is used.src/shared/gatt-server.c:712:25: warning: Variable length array is used.src/shared/gatt-server.c:271:25: warning: Variable length array is used.src/shared/gatt-server.c:614:25: warning: Variable length array is used.src/shared/gatt-server.c:712:25: warning: Variable length array is used.src/shared/gatt-server.c:271:25: warning: Variable length array is used.src/shared/gatt-server.c:614:25: warning: Variable length array is used.src/shared/gatt-server.c:712:25: warning: Variable length array is used. https://github.com/bluez/bluez/pull/2422 --- Regards, Linux Bluetooth ^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH v3] gatt-server: Fix integer overflow and 3 CI VLA wanings 2026-08-21 4:46 ` [v2] " bluez.test.bot @ 2026-08-21 7:35 ` zuohsh 2026-08-21 8:42 ` [v3] " bluez.test.bot 0 siblings, 1 reply; 7+ messages in thread From: zuohsh @ 2026-08-21 7:35 UTC (permalink / raw) To: linux-bluetooth; +Cc: zuohsh By using size_t for realloc len and rejecting allocations exceeding UINT16_MAX , to prevent truncation into the uint16_t field. Fix CI warnings: Variable length array is used, use malloc/free instead. --- src/shared/gatt-server.c | 42 ++++++++++++++++++++++++++++++++++------ 1 file changed, 36 insertions(+), 6 deletions(-) diff --git a/src/shared/gatt-server.c b/src/shared/gatt-server.c index 709a8f94b..516fceb8e 100644 --- a/src/shared/gatt-server.c +++ b/src/shared/gatt-server.c @@ -268,7 +268,7 @@ static void read_by_grp_type_cb(struct bt_att_chan *chan, uint16_t mtu, uint16_t start, end; bt_uuid_t type; bt_uuid_t prim, snd; - uint8_t rsp_pdu[mtu]; + uint8_t *rsp_pdu = NULL; uint16_t rsp_len; uint8_t ecode = 0; uint16_t ehandle = 0; @@ -319,6 +319,12 @@ static void read_by_grp_type_cb(struct bt_att_chan *chan, uint16_t mtu, goto error; } + rsp_pdu = malloc(mtu); + if (!rsp_pdu) { + ecode = BT_ATT_ERROR_INSUFFICIENT_RESOURCES; + goto error; + } + if (!encode_read_by_grp_type_rsp(server->db, q, server->att, mtu, rsp_pdu, &rsp_len)) { ecode = BT_ATT_ERROR_UNLIKELY; @@ -330,11 +336,14 @@ static void read_by_grp_type_cb(struct bt_att_chan *chan, uint16_t mtu, bt_att_chan_send_rsp(chan, BT_ATT_OP_READ_BY_GRP_TYPE_RSP, rsp_pdu, rsp_len); + free(rsp_pdu); + return; error: queue_destroy(q, NULL); bt_att_chan_send_error_rsp(chan, opcode, ehandle, ecode); + free(rsp_pdu); } static void async_read_op_destroy(struct async_read_op *op) @@ -611,7 +620,7 @@ static void find_info_cb(struct bt_att_chan *chan, uint16_t mtu, uint8_t opcode, { struct bt_gatt_server *server = user_data; uint16_t start, end; - uint8_t rsp_pdu[mtu]; + uint8_t *rsp_pdu = NULL; uint16_t rsp_len; uint8_t ecode = 0; uint16_t ehandle = 0; @@ -648,6 +657,12 @@ static void find_info_cb(struct bt_att_chan *chan, uint16_t mtu, uint8_t opcode, goto error; } + rsp_pdu = malloc(mtu); + if (!rsp_pdu) { + ecode = BT_ATT_ERROR_INSUFFICIENT_RESOURCES; + goto error; + } + if (!encode_find_info_rsp(server->db, q, mtu, rsp_pdu, &rsp_len)) { ecode = BT_ATT_ERROR_UNLIKELY; goto error; @@ -657,11 +672,14 @@ static void find_info_cb(struct bt_att_chan *chan, uint16_t mtu, uint8_t opcode, queue_destroy(q, NULL); + free(rsp_pdu); + return; error: bt_att_chan_send_error_rsp(chan, opcode, ehandle, ecode); queue_destroy(q, NULL); + free(rsp_pdu); } @@ -709,7 +727,7 @@ static void find_by_type_val_cb(struct bt_att_chan *chan, uint16_t mtu, struct bt_gatt_server *server = user_data; uint16_t start, end, uuid16; struct find_by_type_val_data data; - uint8_t rsp_pdu[mtu]; + uint8_t *rsp_pdu = NULL; uint16_t ehandle = 0; bt_uuid_t uuid; @@ -718,6 +736,12 @@ static void find_by_type_val_cb(struct bt_att_chan *chan, uint16_t mtu, goto error; } + rsp_pdu = malloc(mtu); + if (!rsp_pdu) { + data.ecode = BT_ATT_ERROR_INSUFFICIENT_RESOURCES; + goto error; + } + data.pdu = rsp_pdu; data.len = 0; data.mtu = mtu; @@ -752,10 +776,13 @@ static void find_by_type_val_cb(struct bt_att_chan *chan, uint16_t mtu, bt_att_chan_send_rsp(chan, BT_ATT_OP_FIND_BY_TYPE_RSP, data.pdu, data.len); + free(rsp_pdu); + return; error: bt_att_chan_send_error_rsp(chan, opcode, ehandle, data.ecode); + free(rsp_pdu); } static void async_write_op_destroy(struct async_write_op *op) @@ -1174,12 +1201,12 @@ static bool append_prep_data(struct prep_write_data *prep_data, uint16_t handle, uint16_t length, uint8_t *value) { uint8_t *val; - uint16_t len; + size_t len; if (!length) return true; - len = prep_data->length + length; + len = (size_t)prep_data->length + (size_t)length; val = realloc(prep_data->value, len); if (!val) @@ -1188,7 +1215,10 @@ static bool append_prep_data(struct prep_write_data *prep_data, uint16_t handle, memcpy(val + prep_data->length, value, length); prep_data->value = val; - prep_data->length = len; + + if (len > UINT16_MAX) + return false; + prep_data->length = (uint16_t)len; return true; } -- 2.43.0 Add fixing for CI reported wanings: https://github.com/bluez/bluez/actions/runs/32445843490/job/96665153549?pr=2422 2026-08-21T04:46:41.2241065Z src/shared/gatt-server.c:271:25: warning: Variable length array is used.src/shared/gatt-server.c:614:25: warning: Variable length array is used.src/shared/gatt-server.c:712:25: warning: Variable length array is used.src/shared/gatt-server.c:271:25: warning: Variable length array is used.src/shared/gatt-server.c:614:25: warning: Variable length array is used.src/shared/gatt-server.c:712:25: warning: Variable length array is used.src/shared/gatt-server.c:271:25: warning: Variable length array is used.src/shared/gatt-server.c:614:25: warning: Variable length array is used.src/shared/gatt-server.c:712:25: warning: Variable length array is used. ^ permalink raw reply related [flat|nested] 7+ messages in thread
* RE: [v3] gatt-server: Fix integer overflow and 3 CI VLA wanings 2026-08-21 7:35 ` [PATCH v3] gatt-server: Fix integer overflow and 3 CI VLA wanings zuohsh @ 2026-08-21 8:42 ` bluez.test.bot 2026-08-21 10:40 ` [PATCH v3] " zuohsh 0 siblings, 1 reply; 7+ messages in thread From: bluez.test.bot @ 2026-08-21 8:42 UTC (permalink / raw) To: linux-bluetooth, zuohongsheng [-- Attachment #1: Type: text/plain, Size: 1856 bytes --] This is automated email and please do not reply to this email! Dear submitter, Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series: PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1149533 ---Test result--- Test Summary: CheckPatch PASS 0.48 seconds GitLint FAIL 0.32 seconds BuildEll PASS 20.23 seconds BluezMake PASS 575.47 seconds MakeCheck PASS 1.09 seconds MakeDistcheck PASS 154.83 seconds CheckValgrind PASS 156.52 seconds CheckSmatch PASS 307.18 seconds bluezmakeextell PASS 100.11 seconds IncrementalBuild PASS 579.53 seconds ScanBuild PASS 952.04 seconds Details ############################## Test: GitLint - FAIL Desc: Run gitlint Output: [v3] gatt-server: Fix integer overflow and 3 CI VLA wanings 14: B1 Line exceeds max length (677>80): "2026-08-21T04:46:41.2241065Z src/shared/gatt-server.c:271:25: warning: Variable length array is used.src/shared/gatt-server.c:614:25: warning: Variable length array is used.src/shared/gatt-server.c:712:25: warning: Variable length array is used.src/shared/gatt-server.c:271:25: warning: Variable length array is used.src/shared/gatt-server.c:614:25: warning: Variable length array is used.src/shared/gatt-server.c:712:25: warning: Variable length array is used.src/shared/gatt-server.c:271:25: warning: Variable length array is used.src/shared/gatt-server.c:614:25: warning: Variable length array is used.src/shared/gatt-server.c:712:25: warning: Variable length array is used." https://github.com/bluez/bluez/pull/2423 --- Regards, Linux Bluetooth ^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH v3] gatt-server: Fix integer overflow and 3 CI VLA wanings 2026-08-21 8:42 ` [v3] " bluez.test.bot @ 2026-08-21 10:40 ` zuohsh 2026-08-21 11:51 ` [v3] " bluez.test.bot 0 siblings, 1 reply; 7+ messages in thread From: zuohsh @ 2026-08-21 10:40 UTC (permalink / raw) To: linux-bluetooth; +Cc: zuohsh By using size_t for realloc len and rejecting allocations exceeding UINT16_MAX , to prevent truncation into the uint16_t field. Fix CI warnings: Variable length array is used, use malloc/free instead. --- src/shared/gatt-server.c | 42 ++++++++++++++++++++++++++++++++++------ 1 file changed, 36 insertions(+), 6 deletions(-) diff --git a/src/shared/gatt-server.c b/src/shared/gatt-server.c index 709a8f94b..516fceb8e 100644 --- a/src/shared/gatt-server.c +++ b/src/shared/gatt-server.c @@ -268,7 +268,7 @@ static void read_by_grp_type_cb(struct bt_att_chan *chan, uint16_t mtu, uint16_t start, end; bt_uuid_t type; bt_uuid_t prim, snd; - uint8_t rsp_pdu[mtu]; + uint8_t *rsp_pdu = NULL; uint16_t rsp_len; uint8_t ecode = 0; uint16_t ehandle = 0; @@ -319,6 +319,12 @@ static void read_by_grp_type_cb(struct bt_att_chan *chan, uint16_t mtu, goto error; } + rsp_pdu = malloc(mtu); + if (!rsp_pdu) { + ecode = BT_ATT_ERROR_INSUFFICIENT_RESOURCES; + goto error; + } + if (!encode_read_by_grp_type_rsp(server->db, q, server->att, mtu, rsp_pdu, &rsp_len)) { ecode = BT_ATT_ERROR_UNLIKELY; @@ -330,11 +336,14 @@ static void read_by_grp_type_cb(struct bt_att_chan *chan, uint16_t mtu, bt_att_chan_send_rsp(chan, BT_ATT_OP_READ_BY_GRP_TYPE_RSP, rsp_pdu, rsp_len); + free(rsp_pdu); + return; error: queue_destroy(q, NULL); bt_att_chan_send_error_rsp(chan, opcode, ehandle, ecode); + free(rsp_pdu); } static void async_read_op_destroy(struct async_read_op *op) @@ -611,7 +620,7 @@ static void find_info_cb(struct bt_att_chan *chan, uint16_t mtu, uint8_t opcode, { struct bt_gatt_server *server = user_data; uint16_t start, end; - uint8_t rsp_pdu[mtu]; + uint8_t *rsp_pdu = NULL; uint16_t rsp_len; uint8_t ecode = 0; uint16_t ehandle = 0; @@ -648,6 +657,12 @@ static void find_info_cb(struct bt_att_chan *chan, uint16_t mtu, uint8_t opcode, goto error; } + rsp_pdu = malloc(mtu); + if (!rsp_pdu) { + ecode = BT_ATT_ERROR_INSUFFICIENT_RESOURCES; + goto error; + } + if (!encode_find_info_rsp(server->db, q, mtu, rsp_pdu, &rsp_len)) { ecode = BT_ATT_ERROR_UNLIKELY; goto error; @@ -657,11 +672,14 @@ static void find_info_cb(struct bt_att_chan *chan, uint16_t mtu, uint8_t opcode, queue_destroy(q, NULL); + free(rsp_pdu); + return; error: bt_att_chan_send_error_rsp(chan, opcode, ehandle, ecode); queue_destroy(q, NULL); + free(rsp_pdu); } @@ -709,7 +727,7 @@ static void find_by_type_val_cb(struct bt_att_chan *chan, uint16_t mtu, struct bt_gatt_server *server = user_data; uint16_t start, end, uuid16; struct find_by_type_val_data data; - uint8_t rsp_pdu[mtu]; + uint8_t *rsp_pdu = NULL; uint16_t ehandle = 0; bt_uuid_t uuid; @@ -718,6 +736,12 @@ static void find_by_type_val_cb(struct bt_att_chan *chan, uint16_t mtu, goto error; } + rsp_pdu = malloc(mtu); + if (!rsp_pdu) { + data.ecode = BT_ATT_ERROR_INSUFFICIENT_RESOURCES; + goto error; + } + data.pdu = rsp_pdu; data.len = 0; data.mtu = mtu; @@ -752,10 +776,13 @@ static void find_by_type_val_cb(struct bt_att_chan *chan, uint16_t mtu, bt_att_chan_send_rsp(chan, BT_ATT_OP_FIND_BY_TYPE_RSP, data.pdu, data.len); + free(rsp_pdu); + return; error: bt_att_chan_send_error_rsp(chan, opcode, ehandle, data.ecode); + free(rsp_pdu); } static void async_write_op_destroy(struct async_write_op *op) @@ -1174,12 +1201,12 @@ static bool append_prep_data(struct prep_write_data *prep_data, uint16_t handle, uint16_t length, uint8_t *value) { uint8_t *val; - uint16_t len; + size_t len; if (!length) return true; - len = prep_data->length + length; + len = (size_t)prep_data->length + (size_t)length; val = realloc(prep_data->value, len); if (!val) @@ -1188,7 +1215,10 @@ static bool append_prep_data(struct prep_write_data *prep_data, uint16_t handle, memcpy(val + prep_data->length, value, length); prep_data->value = val; - prep_data->length = len; + + if (len > UINT16_MAX) + return false; + prep_data->length = (uint16_t)len; return true; } -- 2.43.0 Add fixing for CI reported CheckSmatch wanings. ^ permalink raw reply related [flat|nested] 7+ messages in thread
* RE: [v3] gatt-server: Fix integer overflow and 3 CI VLA wanings 2026-08-21 10:40 ` [PATCH v3] " zuohsh @ 2026-08-21 11:51 ` bluez.test.bot 0 siblings, 0 replies; 7+ messages in thread From: bluez.test.bot @ 2026-08-21 11:51 UTC (permalink / raw) To: linux-bluetooth, zuohongsheng [-- Attachment #1: Type: text/plain, Size: 988 bytes --] This is automated email and please do not reply to this email! Dear submitter, Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series: PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1149710 ---Test result--- Test Summary: CheckPatch PASS 0.48 seconds GitLint PASS 0.32 seconds BuildEll PASS 20.20 seconds BluezMake PASS 610.40 seconds MakeCheck PASS 1.08 seconds MakeDistcheck PASS 157.84 seconds CheckValgrind PASS 159.36 seconds CheckSmatch PASS 311.31 seconds bluezmakeextell PASS 102.68 seconds IncrementalBuild PASS 608.94 seconds ScanBuild PASS 971.03 seconds https://github.com/bluez/bluez/pull/2425 --- Regards, Linux Bluetooth ^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2026-08-21 11:51 UTC | newest] Thread overview: 7+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-07-23 8:42 [PATCH BlueZ] gatt-server: Fix integer overflow zuohsh 2026-08-21 3:31 ` [PATCH v2] " zuohsh 2026-08-21 4:46 ` [v2] " bluez.test.bot 2026-08-21 7:35 ` [PATCH v3] gatt-server: Fix integer overflow and 3 CI VLA wanings zuohsh 2026-08-21 8:42 ` [v3] " bluez.test.bot 2026-08-21 10:40 ` [PATCH v3] " zuohsh 2026-08-21 11:51 ` [v3] " bluez.test.bot
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox