[bluez/bluez] 476cbe: monitor: Fix stack-buffer-overflow in packet_hci_s...

[bluez/bluez] 476cbe: monitor: Fix stack-buffer-overflow in packet_hci_s...

[github-actions[bot]]

  Branch: refs/heads/1173024
  Home:   https://github.com/bluez/bluez
  Commit: 476cbe9a5a86f0763addd45d0a17b52dfc2af874
      https://github.com/bluez/bluez/commit/476cbe9a5a86f0763addd45d0a17b52dfc2af874
  Author: Zijun Hu <zijun.hu@oss.qualcomm.com>
  Date:   2026-09-24 (Thu, 24 Sep 2026)

  Changed paths:
    M monitor/packet.c

  Log Message:
  -----------
  monitor: Fix stack-buffer-overflow in packet_hci_scodata()

Fix below handle_str[] OOB by:
- Increase buffer size.
- Use snprintf() instead of sprintf().
Also access SCO header fields after validating header size.

AddressSanitizer: stack-buffer-overflow on address 0x7bd1443dedba at pc 0x7bd1474ced69 bp 0x7ffdb0324880 sp 0x7ffdb0324010
WRITE of size 40 at 0x7bd1443dedba thread T0
    #0 0x7bd1474ced68 in vsprintf ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:1671
    #1 0x7bd1474d0643 in __sprintf_chk ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:1719
    #2 0x5f5c39d02ea7 in sprintf /usr/include/x86_64-linux-gnu/bits/stdio2.h:30
    #3 0x5f5c39d02ea7 in handle_str_append_addr ../monitor/packet.c:14995
    #4 0x5f5c39d58f19 in packet_hci_scodata ../monitor/packet.c:15125
    #5 0x5f5c39d5eaf9 in packet_monitor ../monitor/packet.c:4841
    #6 0x5f5c39cc4094 in data_callback ../monitor/control.c:991
    #7 0x5f5c39e7fa7d in mainloop_run ../src/shared/mainloop.c:104
    #8 0x7bd1474e81d86 in mainloop_run_with_signal ../src/shared/mainloop-notify.c:196
    #9 0x5f5c39cbbb4c in main ../monitor/main.c:315
    #10 0x7bd14662a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #11 0x7bd14662a28a in __libc_start_main_impl ../sysdeps/nptl/libc-start.c:360
    #12 0x5f5c39cbc664 in _start (/usr/bin/btmon+0x2b2664) (BuildId: 370a6386c9fceae18f9a456c0c029ac378b0b070)

Fixes: 611f84a0ff0e ("monitor: Annotate ACL/SCO/ISO data with device address")



To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications