2014-12-15 13:59:14

by Gowtham Anandha Babu

Subject: [PATCH] monitor/l2cap: Fix buffer overflow issue

String copy function overflows destination buffer.
strcat(str, "LinkKey ");
^~~~~~~~~~~~~~~~~~~~~~~
---
monitor/l2cap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/monitor/l2cap.c b/monitor/l2cap.c
index 6d9b1ce..27341fd 100644
--- a/monitor/l2cap.c
+++ b/monitor/l2cap.c
@@ -2379,7 +2379,7 @@ static void print_smp_auth_req(uint8_t auth_req)

static void print_smp_key_dist(const char *label, uint8_t dist)
{
- char str[19];
+ char str[27];

if (!(dist & 0x07)) {
strcpy(str, "<none> ");
--
1.9.1

2014-12-16 12:31:33

by Johan Hedberg

Subject: Re: [PATCH] monitor/l2cap: Fix buffer overflow issue

Hi Gowtham,

On Mon, Dec 15, 2014, Gowtham Anandha Babu wrote:
> String copy function overflows destination buffer.
> strcat(str, "LinkKey ");
> ^~~~~~~~~~~~~~~~~~~~~~~
> ---
> monitor/l2cap.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)

Applied. Thanks.

Johan