Re: [PATCH] Fix Out-of-Bounds Read in AVRCP GetFolderItems parsing

[Bastien Nocera <hadess@hadess.net>]

On Sun, 2026-08-02 at 08:06 +0400, Elman Shahbazov wrote:
> Hello BlueZ maintainers and Red Hat Security team,
> 
> <snip>
> 4. Proof of Concept (PoC)
> I have attached poc_avrcp_obb.c which extracts the vulnerable logic
> and simulates
> the attack using a 14-byte malicious packet with an inflated namesize
> of 1000.

Do you have a proof of concept for the parse_media_folder() vuln?

I'm trying to integrate those into test cases.

> 
> To verify the vulnerability:
> 1. Compile with AddressSanitizer:
>    gcc -fsanitize=address -g -o poc_avrcp_oob poc_avrcp_obb.c
> 2. Run the binary:
>    ./poc_avrcp_oob
> 
> ASan will immediately detect the out-of-bounds access and abort:
> =================================================================
> ==113741==ERROR: AddressSanitizer: stack-buffer-overflow on address
> 0x...
> READ of size 254 at 0x... thread T0
>     #0 0x... in memcpy
>     #1 0x... in parse_media_element_vuln
>     #2 0x... in main
> SUMMARY: AddressSanitizer: stack-buffer-overflow in
> parse_media_element_vuln
> 
> [ 5. Proposed Fix
> The attached patch ensures that the length extracted from the packet
> is strictly
> validated against the remaining bytes in the packet buffer (len)
> before being
> used in memcpy. It also adds boundary checks before accessing
> subsequent offsets.
> 
> Please review the attached .patch file. I am requesting a CVE
> assignment for
> this issue given its impact on system availability.
> 
> Best regards,
> 
> Elman Shahbazov
> Security Researcher