Received: by 2002:a05:6a10:2726:0:0:0:0 with SMTP id ib38csp1233446pxb; Fri, 1 Apr 2022 08:03:41 -0700 (PDT) X-Google-Smtp-Source: ABdhPJxEa/J7tLlLnKdvS/DLMuzAYkBvCqevVTu9XSVYECoYqcY5bE8guL+kcDlp+vM42DlGjY6r X-Received: by 2002:a17:906:f956:b0:6df:d816:264b with SMTP id ld22-20020a170906f95600b006dfd816264bmr216882ejb.354.1648825421268; Fri, 01 Apr 2022 08:03:41 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1648825421; cv=none; d=google.com; s=arc-20160816; b=hsta1n+gdxSRt1iAYslvL02rhrK2ANDgchoPpQfHG8/Y4akB8DBIj0Ewox0Y8pqWvL +6sHOu4IrwZVZhiq5B60lGVBqBS/+/rgO9roNv990Kr06x4E1LCbn8ymvqnjk+iyTxBE exep4XOgBPxHJ2GMPtHcXFIMxUqTIQ89CBwrPvm95U6CTOg+mNBNQav87v3Wgic1PD0g F3ua4m+1E00/CvxNbPGf7g1FELuJbdfe3EPXbNh/J6E6A+NBd6aenLkxIdfedKtrnESu kfGLe7++cMOuCdcYyX8pGfX2oY9OP7TMdrlFCtchlCaJNqW1+OidSt3cG+MqQIbMwiih C/qA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-filter; bh=Zz2LfiDPQjRE4S+t1SxBe7zjawlt+m2EewCPu6tYIYk=; b=OY03V7BnuB7bMu5EYQAgblV/bVdFn0EorPe3kqO1t2li4ifArGVArcxf829FJVdfF8 IdpksUoMdbet0bspJNAXbAGkuHHFYt9Gp8mi9vj0az/AqqMoQPTjLXhrtCzFKuw1auzN Np5CXyYb1PGBnqxs/86cSwp4U2d9brdY54T7AVwAGqU4wIJWvWEU9JY+eyWJLGZ0llBX 42efoWeevtzOMOFyFsVBgE4w1WtPVQN2qHGELAvd7Qln6ckezV/iBzCZQVmTZSWOJbq6 iumJiHFuccrSuaaA7VAfvDgjVNqDT2izQiYiaCVFrBNxQqB842BftnsF3Arpp+q4D6FV 6cOQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-bluetooth-owner@vger.kernel.org Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id v11-20020a170906564b00b006dff6a97a3dsi1672249ejr.412.2022.04.01.08.03.13; Fri, 01 Apr 2022 08:03:41 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-bluetooth-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343542AbiDAK36 (ORCPT + 99 others); Fri, 1 Apr 2022 06:29:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38832 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343546AbiDAK34 (ORCPT ); Fri, 1 Apr 2022 06:29:56 -0400 Received: from mxout04.lancloud.ru (mxout04.lancloud.ru [45.84.86.114]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C0E8526E57F for ; Fri, 1 Apr 2022 03:28:05 -0700 (PDT) Received: from LanCloud DKIM-Filter: OpenDKIM Filter v2.11.0 mxout04.lancloud.ru 4801F20C837F Received: from LanCloud Received: from LanCloud Received: from LanCloud From: Ildar Kamaletdinov To: CC: Ildar Kamaletdinov Subject: [PATCH BlueZ 6/7] device: Limit width of fields in sscanf Date: Fri, 1 Apr 2022 13:27:56 +0300 Message-ID: <20220401102757.3960551-7-i.kamaletdinov@omp.ru> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220401102757.3960551-1-i.kamaletdinov@omp.ru> References: <20220401102757.3960551-1-i.kamaletdinov@omp.ru> MIME-Version: 1.0 Content-Transfer-Encoding: 7BIT Content-Type: text/plain; charset=US-ASCII X-Originating-IP: [192.168.11.198] X-ClientProxiedBy: LFEXT01.lancloud.ru (fd00:f066::141) To LFEX1910.lancloud.ru (fd00:f066::80) X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,SPF_HELO_NONE, SPF_PASS,T_SCC_BODY_TEXT_LINE,UNPARSEABLE_RELAY autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-bluetooth@vger.kernel.org In src/device.c few sscanf does not limit width of uuid field. This could lead to static overflow and stack corruption. Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool. --- src/device.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/src/device.c b/src/device.c index 381faf91c..8dc12d026 100644 --- a/src/device.c +++ b/src/device.c @@ -3790,8 +3790,8 @@ static int load_desc(char *handle, char *value, return -EIO; /* Check if there is any value stored, otherwise it is just the UUID */ - if (sscanf(value, "%04hx:%s", &val, uuid_str) != 2) { - if (sscanf(value, "%s", uuid_str) != 1) + if (sscanf(value, "%04hx:%36s", &val, uuid_str) != 2) { + if (sscanf(value, "%36s", uuid_str) != 1) return -EIO; val = 0; } @@ -3840,9 +3840,9 @@ static int load_chrc(char *handle, char *value, return -EIO; /* Check if there is any value stored */ - if (sscanf(value, GATT_CHARAC_UUID_STR ":%04hx:%02hx:%32s:%s", + if (sscanf(value, GATT_CHARAC_UUID_STR ":%04hx:%02hx:%32s:%36s", &value_handle, &properties, val_str, uuid_str) != 4) { - if (sscanf(value, GATT_CHARAC_UUID_STR ":%04hx:%02hx:%s", + if (sscanf(value, GATT_CHARAC_UUID_STR ":%04hx:%02hx:%36s", &value_handle, &properties, uuid_str) != 3) return -EIO; val_len = 0; @@ -3884,8 +3884,8 @@ static int load_incl(struct gatt_db *db, char *handle, char *value, if (sscanf(handle, "%04hx", &start) != 1) return -EIO; - if (sscanf(value, GATT_INCLUDE_UUID_STR ":%04hx:%04hx:%s", &start, &end, - uuid_str) != 3) + if (sscanf(value, GATT_INCLUDE_UUID_STR ":%04hx:%04hx:%36s", &start, + &end, uuid_str) != 3) return -EIO; /* Log debug message. */ @@ -3918,7 +3918,7 @@ static int load_service(struct gatt_db *db, char *handle, char *value) if (sscanf(handle, "%04hx", &start) != 1) return -EIO; - if (sscanf(value, "%[^:]:%04hx:%s", type, &end, uuid_str) != 3) + if (sscanf(value, "%[^:]:%04hx:%36s", type, &end, uuid_str) != 3) return -EIO; if (g_str_equal(type, GATT_PRIM_SVC_UUID_STR)) -- 2.35.1