[bluez/bluez] d44af9: adv_monitor: Fix buffer overflow caused by integer...

[hadess <noreply@github.com>]

  Branch: refs/heads/1145281
  Home:   https://github.com/bluez/bluez
  Commit: d44af9f092d716951accca6ed95fa6a80a96e2d2
      https://github.com/bluez/bluez/commit/d44af9f092d716951accca6ed95fa6a80a96e2d2
  Author: Bastien Nocera <hadess@hadess.net>
  Date:   2026-08-13 (Thu, 13 Aug 2026)

  Changed paths:
    M src/adv_monitor.c

  Log Message:
  -----------
  adv_monitor: Fix buffer overflow caused by integer overflow

In src/adv_monitor.c, merged_pattern_send_add_pattern(), and with a
large merged_pattern->patterns list, it's possible to overflow cp_len,
an 8-bit integer:
pattern_count = queue_length(merged_pattern->patterns);
cp_len = sizeof(*cp) + pattern_count * sizeof(struct mgmt_adv_pattern);

Eight patterns require 273 bytes of command storage, but assigning
that result to uint8_t cp_len wraps it to 17 before allocation.

The loop that follows does not use the truncated size; it still copies
all eight 34-byte struct mgmt_adv_pattern records into the heap object.
The mismatch between the wrapped allocation size and the full copy
volume produces a large, deterministic heap overwrite.

Fix this in 2 ways in the function itself:
1) increase the size of cp_len, as 8 patterns would overflow it, and some
   typical Bluetooth devices can support 16 patterns
2) Store the result of the multiplication in a 64-bit integer before
   checking whether it's bigger than our 16-bit cp_len

A similar bug exists in merged_pattern_send_add_pattern_rssi().

Reported-by: @ax-nnlabs (for merged_pattern_send_add_pattern())
Reported-by: Aisle Research (for merged_pattern_send_add_pattern_rssi())


  Commit: 3a78ed23d7d4f8110aff3306703753c1c2dc6dea
      https://github.com/bluez/bluez/commit/3a78ed23d7d4f8110aff3306703753c1c2dc6dea
  Author: Bastien Nocera <hadess@hadess.net>
  Date:   2026-08-13 (Thu, 13 Aug 2026)

  Changed paths:
    M src/adv_monitor.c

  Log Message:
  -----------
  adv_monitor: Ignore additional patterns past what's supported

Ignore patterns beyond what the adapter supports.

Suggested-by: Aisle Research


Compare: https://github.com/bluez/bluez/compare/d44af9f092d7%5E...3a78ed23d7d4

To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications