michaelh/zephyr
1
0
Fork 0
Code Releases Activity

Bluetooth: Classic: Add length check in bluetooth classic

Browse source 
Added length checks for user input in `sdp_client_receive` and
`l2cap_br_info_rsp`.

Signed-off-by: Eunkyu Lee <mochaccino.00.00@gmail.com>
This commit is contained in:
Eunkyu Lee 2024-06-14 04:29:42 +00:00 • committed by Alberto Escolar
commit 88881257ab
2 changed files with 15 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

10
subsys/bluetooth/host/classic/l2cap_br.c
View file

@ -506,6 +506,11 @@ static int l2cap_br_info_rsp(struct bt_l2cap_br *l2cap, uint8_t ident,
switch (type) {
case BT_L2CAP_INFO_FEAT_MASK:
if (buf->len < sizeof(uint32_t)) {
LOG_ERR("Invalid remote info feat mask");
err = -EINVAL;
break;
}
l2cap->info_feat_mask = net_buf_pull_le32(buf);
LOG_DBG("remote info mask 0x%08x", l2cap->info_feat_mask);
@ -516,6 +521,11 @@ static int l2cap_br_info_rsp(struct bt_l2cap_br *l2cap, uint8_t ident,
l2cap_br_get_info(l2cap, BT_L2CAP_INFO_FIXED_CHAN);
return 0;
case BT_L2CAP_INFO_FIXED_CHAN:
if (buf->len < sizeof(uint8_t)) {
LOG_ERR("Invalid remote info fixed chan");
err = -EINVAL;
break;
}
l2cap->info_fixed_chan = net_buf_pull_u8(buf);
LOG_DBG("remote fixed channel mask 0x%02x", l2cap->info_fixed_chan);

5
subsys/bluetooth/host/classic/sdp.c
View file

@ -1750,6 +1750,11 @@ static int sdp_client_receive(struct bt_l2cap_chan *chan, struct net_buf *buf)
switch (hdr->op_code) {
case BT_SDP_SVC_SEARCH_ATTR_RSP:
/* Check the buffer len for the length field */
if (buf->len < sizeof(uint16_t)) {
LOG_ERR("Invalid frame payload length");
return 0;
}
/* Get number of attributes in this frame. */
frame_len = net_buf_pull_be16(buf);
/* Check valid buf len for attribute list and cont state */