Re: [PATCH v2 3/3] Bluetooth: Validate data size before accessing mgmt commands
From: Johan Hedberg <hidden>
Date: 2011-02-25 15:50:20
Hi Szymon, On Wed, Feb 23, 2011, Szymon Janc wrote:
Crafted (too small) data buffer could result in reading data outside of buffer. Validate buffer size and return EINVAL if size is wrong.. Signed-off-by: Szymon Janc <redacted>
The patch looks good, except for this part:
quoted hunk ↗ jump to hunk
@@ -1170,6 +1219,10 @@ static int user_confirm_reply(struct sock *sk, u16 index, unsigned char *data, BT_DBG(""); + if (len != sizeof(*cp)) + return cmd_status(sk, index, MGMT_OP_USER_CONFIRM_REPLY, + EINVAL); + if (success) { mgmt_op = MGMT_OP_USER_CONFIRM_REPLY; hci_op = HCI_OP_USER_CONFIRM_REPLY;
Note that this function is also used for the negative reply so you can't hard-code the MGMT_OP_USER_CONFIRM_REPLY in the cmd_status. Instead move the if (success) part earlier in the function and then use mgmt_op for the cmd_status. When that's fixed: Acked-by: Johan Hedberg <redacted> Johan