[bluez/bluez] 496623: unit: Add test for sdp_xml_parse_record()
From: hadess <hidden>
Date: 2026-08-11 15:43:01
Branch: refs/heads/1144151 Home: https://github.com/bluez/bluez Commit: 496623162109aa1a97bf1a9c8e6049ea21336be8 https://github.com/bluez/bluez/commit/496623162109aa1a97bf1a9c8e6049ea21336be8 Author: Bastien Nocera [off-list ref] Date: 2026-08-11 (Tue, 11 Aug 2026) Changed paths: M Makefile.am A unit/sdp-xml/Bluetooth_HID-sdp_record.xml A unit/sdp-xml/qt-SerialPortSDPRecord.xml A unit/test-sdp-xml.c Log Message: ----------- unit: Add test for sdp_xml_parse_record() This adds 2 example XML files from other repositories, under a fair use license exception. Commit: 9f971c42f87398dd8e3b701f718c9c3d26549a11 https://github.com/bluez/bluez/commit/9f971c42f87398dd8e3b701f718c9c3d26549a11 Author: Bastien Nocera [off-list ref] Date: 2026-08-11 (Tue, 11 Aug 2026) Changed paths: M src/sdp-xml.c Log Message: ----------- sdp-xml: Fix crash caused by type confusion when parsing crafted SDP XML When element_end() processes </attribute>, it frees ctx_data->stack_head and clears the stack even if parsing is still nested inside a parent container. If a crafted ServiceRecord places a nested <attribute> inside <sequence>, a later sibling scalar element such as <uint64> can become the new stack head. When the closing </sequence> is then processed, compute_seq_size() is reached without first validating that the current node is actually a sequence. sdp_data_t.val stores both scalar members such as uint64 and the dataseq pointer in the same union. As a result, attacker-controlled scalar data can be reinterpreted as a linked-list pointer and traversed until bluetoothd crashes. See https://github.com/bluez/bluez/security/advisories/GHSA-7mmr-gwqx-vc34 Reported-by: Aisle Research Co-authored-by: Aisle Research Commit: e033e4bf68f71c4c85a78ef3f4adad058b84b3d1 https://github.com/bluez/bluez/commit/e033e4bf68f71c4c85a78ef3f4adad058b84b3d1 Author: Bastien Nocera [off-list ref] Date: 2026-08-11 (Tue, 11 Aug 2026) Changed paths: A unit/sdp-xml/compute-seq-size-type-confusion.xml M unit/test-sdp-xml.c Log Message: ----------- unit: Add test for sdp-xml type-confusion bug See https://github.com/bluez/bluez/security/advisories/GHSA-7mmr-gwqx-vc34 Co-authored-by: Aisle Research Commit: fa35605795af977c269e69e8e5830092d91fcbaa https://github.com/bluez/bluez/commit/fa35605795af977c269e69e8e5830092d91fcbaa Author: Bastien Nocera [off-list ref] Date: 2026-08-11 (Tue, 11 Aug 2026) Changed paths: M src/sdp-xml.c Log Message: ----------- sdp-xml: Fix memory leak when adding duplicate attributes When sdp_attr_add() fails because an attribute is duplicated, don't unset its pointer in the parsing context data. As the attribute wasn't added to the record, the ownership of the attribute didn't get passed to the record either. Don't set the pointer to NULL so it gets freed when cleaning up the context. Fixes those 2 ASan warnings: Direct leak of 48 byte(s) in 1 object(s) allocated from: #0 0x7f896a8ef24f in calloc (/lib64/libasan.so.8+0xef24f) (BuildId: 5395ec74f54d9ec7bf97c06583dd39a96c230822) #1 0x562042b747f2 in sdp_data_alloc_with_length lib/bluetooth/sdp.c:350 Indirect leak of 2 byte(s) in 1 object(s) allocated from: #0 0x7f896a8ef24f in calloc (/lib64/libasan.so.8+0xef24f) (BuildId: 5395ec74f54d9ec7bf97c06583dd39a96c230822) #1 0x562042b74bd7 in sdp_data_alloc_with_length lib/bluetooth/sdp.c:425 See https://github.com/bluez/bluez/security/advisories/GHSA-75v6-6q44-57hc Reported-by: Aisle Research Co-authored-by: Aisle Research Commit: a851bde7faa851727369bfa6ce01de635ef17b1a https://github.com/bluez/bluez/commit/a851bde7faa851727369bfa6ce01de635ef17b1a Author: Bastien Nocera [off-list ref] Date: 2026-08-11 (Tue, 11 Aug 2026) Changed paths: A unit/sdp-xml/duplicate-attribute.xml M unit/test-sdp-xml.c Log Message: ----------- unit: Add test for sdp-xml duplicate attribute bug See https://github.com/bluez/bluez/security/advisories/GHSA-75v6-6q44-57hc Co-authored-by: Aisle Research Commit: ef4b6f6d4a7db8575b0de9a335e1662b8bf997d0 https://github.com/bluez/bluez/commit/ef4b6f6d4a7db8575b0de9a335e1662b8bf997d0 Author: Bastien Nocera [off-list ref] Date: 2026-08-11 (Tue, 11 Aug 2026) Changed paths: M src/sdp-xml.c Log Message: ----------- sdp-xml: Optimise parsing large sequences SDP sequences are stored as single-linked lists, so appending members to a sequence requires finding the tail of the list before the insertion. Finding the tail of the list always starts at the beginning of the list, so takes longer and longer as the list grows bigger. Keep track of the tail to avoid that problem. This cuts down the sequence_on_squared() test from around 3 to 4 seconds to less than 0.1 seconds. Commit: f48d1c05d77b726065c55c95159046ee7c96e9b9 https://github.com/bluez/bluez/commit/f48d1c05d77b726065c55c95159046ee7c96e9b9 Author: Bastien Nocera [off-list ref] Date: 2026-08-11 (Tue, 11 Aug 2026) Changed paths: M unit/test-sdp-xml.c Log Message: ----------- unit: Add test for slow element_end() append This uses 40k iterations as this takes a visible amount of time on a pretty fast desktop machine (3-4 secs on an i9 9900k). See: https://github.com/bluez/bluez/security/advisories/GHSA-4p57-mrcv-r2jc Commit: c7d0d90bb243435cf6cd4c21ece05ba655eed25e https://github.com/bluez/bluez/commit/c7d0d90bb243435cf6cd4c21ece05ba655eed25e Author: Bastien Nocera [off-list ref] Date: 2026-08-11 (Tue, 11 Aug 2026) Changed paths: M src/sdp-xml.c Log Message: ----------- sdp-xml: Fix stack overflow when converting large sequences to XML Don't make convert_raw_data_to_xml() call itself recursively X times if there are X elements in a sequence. AddressSanitizer:DEADLYSIGNAL ================================================================= ==1684518==ERROR: AddressSanitizer: stack-overflow on address 0x7fff7fb40d98 (pc 0x7fbe1ee95c2b bp 0x7fff7fb41610 sp 0x7fff7fb40d70 T0) #0 0x7fbe1ee95c2b in printf_common(void*, char const*, __va_list_tag*) (/lib64/libasan.so.8+0x95c2b) (BuildId: 5395ec74f54d9ec7bf97c06583dd39a96c230822) #1 0x7fbe1eeb72d6 in vsnprintf (/lib64/libasan.so.8+0xb72d6) (BuildId: 5395ec74f54d9ec7bf97c06583dd39a96c230822) #2 0x7fbe1eeb94f4 in snprintf (/lib64/libasan.so.8+0xb94f4) (BuildId: 5395ec74f54d9ec7bf97c06583dd39a96c230822) #3 0x000000401fc2 in convert_raw_data_to_xml ../../../../Projects/jhbuild/bluez/src/sdp-xml.c:709 #4 0x000000401c4f in convert_raw_data_to_xml ../../../../Projects/jhbuild/bluez/src/sdp-xml.c:994 [...] #246 0x000000401c4f in convert_raw_data_to_xml ../../../../Projects/jhbuild/bluez/src/sdp-xml.c:994 SUMMARY: AddressSanitizer: stack-overflow ../../../../Projects/jhbuild/bluez/src/sdp-xml.c:709 in convert_raw_data_to_xml Commit: ba6f402e19e742a2e364eb006e6602631b3699c8 https://github.com/bluez/bluez/commit/ba6f402e19e742a2e364eb006e6602631b3699c8 Author: Bastien Nocera [off-list ref] Date: 2026-08-11 (Tue, 11 Aug 2026) Changed paths: M unit/test-sdp-xml.c Log Message: ----------- unit: Add convert_sdp_record_to_xml() to SDP XML testing This tests SDP binary to XML conversion, including whether a fix for a stack overflow when dealing with large sequences, like in sequence_on_squared(), works correctly. Compare: https://github.com/bluez/bluez/compare/496623162109%5E...ba6f402e19e7 To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications