Linux bluetooth development
 help / color / mirror / Atom feed
* [PATCH BlueZ v1 0/8] Fix handling of malformed GATT PDUs
@ 2026-11-05 22:16 Luiz Augusto von Dentz
  2026-11-05 22:16 ` [PATCH BlueZ v1 1/8] shared/gatt: Validate Read By Type responses Luiz Augusto von Dentz
                   ` (7 more replies)
  0 siblings, 8 replies; 11+ messages in thread
From: Luiz Augusto von Dentz @ 2026-11-05 22:16 UTC (permalink / raw)
  To: linux-bluetooth

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

This fixes several places where GATT PDUs received from the peer are
used without proper validation:

 - Read By Type responses with an invalid Attribute Data Length could
   cause a division by zero and out-of-bounds reads during discovery.
 - Notifications and indications shorter than a handle wrapped the
   value length to 65534, passing data past the received buffer to the
   registered handlers.
 - Read Multiple Variable Length opcodes were missing from the ATT
   tables, so the server never responded to the request, and the
   client response parser did not advance past each value.
 - Database Hash and Extended Properties values were read without
   checking their length.

The Read By Type, notification and Read Multiple Variable Length fixes
come with unit tests reproducing the problem.

Luiz Augusto von Dentz (8):
  shared/gatt: Validate Read By Type responses
  unit/test-gatt: Add malformed Read By Type response tests
  shared/gatt-client: Fix handling of short notifications
  unit/test-gatt: Add short notification test
  shared/att: Add Read Multiple Variable Length opcodes
  shared/gatt-client: Fix parsing Read Multiple Variable Length response
  shared/gatt-client: Check value lengths before reading them
  unit/test-gatt: Add Read Multiple Variable Length tests

 src/shared/att.c          |   3 +
 src/shared/gatt-client.c  |  23 +++-
 src/shared/gatt-helpers.c |   7 +-
 unit/test-gatt.c          | 258 +++++++++++++++++++++++++++++++++++++-
 4 files changed, 278 insertions(+), 13 deletions(-)

-- 
2.56.0


^ permalink raw reply	[flat|nested] 11+ messages in thread
* [PATCH BlueZ v2 1/8] shared/gatt: Validate Read By Type responses
@ 2026-11-06 18:33 Luiz Augusto von Dentz
  2026-11-06 23:18 ` Fix handling of malformed GATT PDUs bluez.test.bot
  0 siblings, 1 reply; 11+ messages in thread
From: Luiz Augusto von Dentz @ 2026-11-06 18:33 UTC (permalink / raw)
  To: linux-bluetooth

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

read_by_type_cb used the peer-provided Attribute Data Length without
validation, causing a division by zero when it was 0 and out-of-bounds
reads when it was shorter than a handle or the PDU itself. Reject such
responses as the other discovery handlers do.

Also check the iterator result and value length before reading the
Server Features value.

Closes: https://github.com/bluez/bluez/issues/2746
Fixes: d21412b96048 ("shared/gatt: Implement "Characteristic Discovery" procedures.")
Fixes: 76d63c91b27a ("shared/gatt-client: Add support for EATT features")
Assisted-by: OpenCode:claude-opus-5.5
---
 src/shared/gatt-client.c  | 6 ++++--
 src/shared/gatt-helpers.c | 7 ++++---
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/src/shared/gatt-client.c b/src/shared/gatt-client.c
index 836a59a8c990..09bd9c971ee5 100644
--- a/src/shared/gatt-client.c
+++ b/src/shared/gatt-client.c
@@ -1565,8 +1565,10 @@ static void db_server_feat_read(bool success, uint8_t att_ecode,
 	if (!result)
 		return;
 
-	bt_gatt_iter_init(&iter, result);
-	bt_gatt_iter_next_read_by_type(&iter, &handle, &len, &value);
+	if (!bt_gatt_iter_init(&iter, result) ||
+			!bt_gatt_iter_next_read_by_type(&iter, &handle,
+						&len, &value) || !len)
+		return;
 
 	DBG(client, "Server Features found: handle 0x%04x "
 				"length 0x%04x value 0x%02x", handle, len,
diff --git a/src/shared/gatt-helpers.c b/src/shared/gatt-helpers.c
index b3d5d8f1a483..e3281ec17758 100644
--- a/src/shared/gatt-helpers.c
+++ b/src/shared/gatt-helpers.c
@@ -1299,14 +1299,15 @@ static void read_by_type_cb(uint8_t opcode, const void *pdu,
 		goto done;
 	}
 
-	if (opcode != BT_ATT_OP_READ_BY_TYPE_RSP || !pdu) {
+	if (opcode != BT_ATT_OP_READ_BY_TYPE_RSP || !pdu || length < 3) {
 		success = false;
 		att_ecode = 0;
 		goto done;
 	}
 
-	data_length = ((uint8_t *) pdu)[0];
-	if (((length - 1) % data_length)) {
+	data_length = ((const uint8_t *) pdu)[0];
+	if (data_length < 2 || data_length > length - 1U ||
+					(length - 1) % data_length) {
 		success = false;
 		att_ecode = 0;
 		goto done;
-- 
2.56.0


^ permalink raw reply related	[flat|nested] 11+ messages in thread
end of thread, other threads:[~2026-11-06 23:18 UTC | newest]

Thread overview: 11+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-11-05 22:16 [PATCH BlueZ v1 0/8] Fix handling of malformed GATT PDUs Luiz Augusto von Dentz
2026-11-05 22:16 ` [PATCH BlueZ v1 1/8] shared/gatt: Validate Read By Type responses Luiz Augusto von Dentz
2026-11-05 23:40   ` Fix handling of malformed GATT PDUs bluez.test.bot
2026-11-05 22:16 ` [PATCH BlueZ v1 2/8] unit/test-gatt: Add malformed Read By Type response tests Luiz Augusto von Dentz
2026-11-05 22:16 ` [PATCH BlueZ v1 3/8] shared/gatt-client: Fix handling of short notifications Luiz Augusto von Dentz
2026-11-05 22:16 ` [PATCH BlueZ v1 4/8] unit/test-gatt: Add short notification test Luiz Augusto von Dentz
2026-11-05 22:16 ` [PATCH BlueZ v1 5/8] shared/att: Add Read Multiple Variable Length opcodes Luiz Augusto von Dentz
2026-11-05 22:16 ` [PATCH BlueZ v1 6/8] shared/gatt-client: Fix parsing Read Multiple Variable Length response Luiz Augusto von Dentz
2026-11-05 22:16 ` [PATCH BlueZ v1 7/8] shared/gatt-client: Check value lengths before reading them Luiz Augusto von Dentz
2026-11-05 22:16 ` [PATCH BlueZ v1 8/8] unit/test-gatt: Add Read Multiple Variable Length tests Luiz Augusto von Dentz
  -- strict thread matches above, loose matches on Subject: below --
2026-11-06 18:33 [PATCH BlueZ v2 1/8] shared/gatt: Validate Read By Type responses Luiz Augusto von Dentz
2026-11-06 23:18 ` Fix handling of malformed GATT PDUs bluez.test.bot

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox