* [bluez/bluez] e7df84: sdp: Prevent integer underflow in string attribute...
@ 2026-10-08 9:35 Hui Peng
0 siblings, 0 replies; only message in thread
From: Hui Peng @ 2026-10-08 9:35 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/1181248
Home: https://github.com/bluez/bluez
Commit: e7df844898637e6a366c380d9c2522be66eb86d1
https://github.com/bluez/bluez/commit/e7df844898637e6a366c380d9c2522be66eb86d1
Author: Hui Peng <benquike@gmail.com>
Date: 2026-10-08 (Thu, 08 Oct 2026)
Changed paths:
M lib/bluetooth/sdp.c
Log Message:
-----------
sdp: Prevent integer underflow in string attribute length calculation
In lib/bluetooth/sdp.c, attribute string length calculations subtract
sizeof(uint8_t) from d->unitSize (e.g. d->unitSize - sizeof(uint8_t)).
When d->unitSize is 0 or less than sizeof(uint8_t), this subtraction
underflows in 32-bit integer arithmetic to a negative/huge length value,
passing invalid sizes to memory allocation and length extraction
functions.
Add explicit lower-bound guards checking d->unitSize > (int)sizeof(uint8_t)
to ensure that when d->unitSize <= sizeof(uint8_t), the calculated string
length is safely set to 0.
Assisted-by: Antigravity
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2026-10-08 9:35 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-08 9:35 [bluez/bluez] e7df84: sdp: Prevent integer underflow in string attribute Hui Peng
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox