* [bluez/bluez] b904ef: sdp: Prevent integer underflow in string attribute...
@ 2026-10-07 23:26 Hui Peng
0 siblings, 0 replies; only message in thread
From: Hui Peng @ 2026-10-07 23:26 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/1181104
Home: https://github.com/bluez/bluez
Commit: b904efdd05008b502133355b76cfc737edf80b9d
https://github.com/bluez/bluez/commit/b904efdd05008b502133355b76cfc737edf80b9d
Author: Hui Peng <benquike@gmail.com>
Date: 2026-10-07 (Wed, 07 Oct 2026)
Changed paths:
M lib/bluetooth/sdp.c
Log Message:
-----------
sdp: Prevent integer underflow in string attribute length calculation
In lib/bluetooth/sdp.c, attribute string length calculations subtract
sizeof(uint8_t) from d->unitSize (e.g. d->unitSize - sizeof(uint8_t)).
When d->unitSize is 0 or less than sizeof(uint8_t), this subtraction
underflows in 32-bit integer arithmetic to a negative/huge length value,
passing invalid sizes to memory allocation and length extraction
functions.
Add explicit lower-bound guards to ensure that when
d->unitSize <= sizeof(uint8_t), the calculated string length is safely
set to 0.
Assisted-by: Antigravity
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2026-10-07 23:26 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-07 23:26 [bluez/bluez] b904ef: sdp: Prevent integer underflow in string attribute Hui Peng
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox