Repository navigation
[PW_SID:1181248] [v2] sdp: Prevent integer underflow in string attribute length calculation - #2635
BluezTestBot wants to merge 1 commit into
Conversation
In lib/bluetooth/sdp.c, attribute string length calculations subtract sizeof(uint8_t) from d->unitSize (e.g. d->unitSize - sizeof(uint8_t)). When d->unitSize is 0 or less than sizeof(uint8_t), this subtraction underflows in 32-bit integer arithmetic to a negative/huge length value, passing invalid sizes to memory allocation and length extraction functions. Add explicit lower-bound guards checking d->unitSize > (int)sizeof(uint8_t) to ensure that when d->unitSize <= sizeof(uint8_t), the calculated string length is safely set to 0. Assisted-by: Antigravity
|
CheckPatch |
|
GitLint |
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Duplication | 0 |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
|
BuildEll |
|
BluezMake |
|
MakeCheck |
|
MakeDistcheck |
|
CheckValgrind |
|
CheckSmatch |
|
bluezmakeextell |
|
TestFunctional |
|
IncrementalBuild |
|
ScanBuild |
In lib/bluetooth/sdp.c, attribute string length calculations subtract
sizeof(uint8_t) from d->unitSize (e.g. d->unitSize - sizeof(uint8_t)).
When d->unitSize is 0 or less than sizeof(uint8_t), this subtraction
underflows in 32-bit integer arithmetic to a negative/huge length value,
passing invalid sizes to memory allocation and length extraction
functions.
Add explicit lower-bound guards checking d->unitSize > (int)sizeof(uint8_t)
to ensure that when d->unitSize <= sizeof(uint8_t), the calculated string
length is safely set to 0.
Assisted-by: Antigravity
Changes in v2:
-Werror=sign-compare compiler warnings reported by BlueZ CI.
lib/bluetooth/sdp.c | 24 ++++++++++++++++++------
1 file changed, 18 insertions(+), 6 deletions(-)