Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Szymon Janc <szymon.janc@codecoup.pl>
To:     linux-bluetooth@vger.kernel.org,
        =?utf-8?B?xYF1a2Fzeg==?= Rymanowski 
        <lukasz.rymanowski@codecoup.pl>
Cc:     =?utf-8?B?xYF1a2Fzeg==?= Rymanowski 
        <lukasz.rymanowski@codecoup.pl>
Subject: Re: [PATCH BlueZ] client: Fix possible stack corruption
Date:   Mon, 11 May 2020 15:29:21 +0200
Message-ID: <5352738.DvuYhMxLoT@ix>
Organization: CODECOUP
In-Reply-To: <20200507214537.4504-1-lukasz.rymanowski@codecoup.pl>
References: <20200507214537.4504-1-lukasz.rymanowski@codecoup.pl>
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="UTF-8"
Sender: linux-bluetooth-owner@vger.kernel.org
Precedence: bulk

Hi =C5=81ukasz,

On Thursday, 7 May 2020 23:45:37 CEST =C5=81ukasz Rymanowski wrote:
> DBUS_TYPE_BOOLEAN is 'int', which does not have to be the same size as
> 'bool'.
> On architecture where bool is smaller than in, getting prepare-authorize
> will corrupt the stack
> ---
>  client/gatt.c | 9 ++++++---
>  1 file changed, 6 insertions(+), 3 deletions(-)
>=20
> diff --git a/client/gatt.c b/client/gatt.c
> index 416eda953..9d35b54fa 100644
> --- a/client/gatt.c
> +++ b/client/gatt.c
> @@ -1860,9 +1860,12 @@ static int parse_options(DBusMessageIter *iter,
> uint16_t *offset, uint16_t *mtu, } else if (strcasecmp(key,
> "prepare-authorize") =3D=3D 0) {
>  			if (var !=3D DBUS_TYPE_BOOLEAN)
>  				return -EINVAL;
> -			if (prep_authorize)
> -				dbus_message_iter_get_basic(&value,
> -							=09
prep_authorize);
> +			if (prep_authorize) {
> +				int tmp;
> +
> +				dbus_message_iter_get_basic(&value,=20
&tmp);
> +				*prep_authorize =3D !!tmp;
> +			}
>  		}
>=20
>  		dbus_message_iter_next(&dict);

Applied, thanks.

=2D-=20
pozdrawiam
Szymon Janc