DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 382A320657
MIME-Version: 1.0
References: <20181031081508.25927-1-acho@suse.com> <20181031081508.25927-3-acho@suse.com>
In-Reply-To: <20181031081508.25927-3-acho@suse.com>
From:   Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Date:   Fri, 2 Nov 2018 13:11:56 +0200
Message-ID: <CABBYNZLVcAnnuPmr7YbWAnifMCa+Q8RW=jPh0sXHn9WC7ekk-w@mail.gmail.com>
Subject: Re: [PATCH 2/3 BlueZ] hcidump:fixed hci frame dump stack-buffer-overflow
To:     "Cho, Yu-Chen" <acho@suse.com>
Cc:     "linux-bluetooth@vger.kernel.org" <linux-bluetooth@vger.kernel.org>,
        jlee@suse.com
Content-Type: text/plain; charset="UTF-8"
Sender: linux-bluetooth-owner@vger.kernel.org
Precedence: bulk

Hi,
On Wed, Oct 31, 2018 at 10:39 AM Cho, Yu-Chen <acho@suse.com> wrote:
>
> hci_dump() didn't check the length of frame, and it would be
> a stack-buffer-overflow error.
>
> Signed-off-by: Cho, Yu-Chen <acho@suse.com>
> ---
>  tools/parser/hci.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/tools/parser/hci.c b/tools/parser/hci.c
> index 8c7bd2581..4e6c36040 100644
> --- a/tools/parser/hci.c
> +++ b/tools/parser/hci.c
> @@ -4107,6 +4107,9 @@ void hci_dump(int level, struct frame *frm)
>
>         frm->ptr++; frm->len--;
>
> +       if (frm->len == 0)
> +               return;
> +
>         switch (type) {
>         case HCI_COMMAND_PKT:
>                 command_dump(level, frm);
> --
> 2.19.1

Applied.

-- 
Luiz Augusto von Dentz