Received-SPF: pass (google.com: domain of linux-bluetooth+bounces-2678-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
From: Silviu Florian Barbulescu <silviu.barbulescu@nxp.com>
To: linux-bluetooth@vger.kernel.org
Cc: mihai-octavian.urzica@nxp.com,
	silviu.barbulescu@nxp.com,
	vlad.pruteanu@nxp.com,
	andrei.istodorescu@nxp.com,
	luiz.dentz@gmail.com,
	iulia.tanasescu@nxp.com
Subject: [PATCH BlueZ 0/1] Fix crash in iov_append_ltv function
Date: Wed, 20 Mar 2024 23:03:49 +0200
Message-Id: <20240320210350.101941-1-silviu.barbulescu@nxp.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
	=?us-ascii?Q?ZutAqePN6G8OWSAns/jvo7kHS42GUqK5hP8lxpbWg45NrJKBXCnAyjg++7xC?=
 =?us-ascii?Q?d8gCVmB09rpmojRfvqooL38t0EgA9bHdwHc65EgMe44JoFp7EFiWSrl5P3bg?=
 =?us-ascii?Q?yvT3XTxZn+257GT192misrYtTwSt+1k0V68m4dXuCW+xV+UYnnj5YgYId9jt?=
 =?us-ascii?Q?JWstSJwLz4huDZB5K04b13eAy7KvJ9MvllX4TL+28x+dLLEaZCHnCmbzTp6T?=
 =?us-ascii?Q?hKx9mzEdWJ9cutY8cthgE0pl9skmt9Lja5IcugacMR9rU+6JmrSkH+iPc4Tp?=
 =?us-ascii?Q?hYbWstWN81cNfsJ6R2mawm874dj8kEIH0vLlhfW454o/MK0l7osBvEH91RJP?=
 =?us-ascii?Q?P0pkzZx5SD+oiSc/DaIoBVTtJHH/70/pFUmBNMURHR/+rZF8Hf2pf9syhNC1?=
 =?us-ascii?Q?ztW8EG7rSusN7awdG3XKscNvcaOHj8KKoZi0KOGNMC5PozMO9bPRjoUe9iOE?=
 =?us-ascii?Q?90KxmySJ3VB7USBRoGDvENAw815/gAYV8swK/DFbazmcMH1v9ec6ysVQ9XDw?=
 =?us-ascii?Q?fvcjVOKjjOB6N3LqYiZYFA3GHNsI5MyDsPJK55VUILX6NaADnjH+btnE22PU?=
 =?us-ascii?Q?Fe3eSSJnDvIrlHnWvh3LjWuug60laDVPhnn2VuCCD7MkhQt6JQWwou4oCIhp?=
 =?us-ascii?Q?6nTTytMJm0K8D4gsdtF7sRVW2StcOBMXOD1m4wdrY1PAwIBVuxoxGXZYF/y5?=
 =?us-ascii?Q?ouzwLdfXsc2/1QOAndJmcE6OWglhbd7Ii5jQ5ffzhr1FzvMBEzKFa77F8TBs?=
 =?us-ascii?Q?uobu65Ywtehw4YlTez0b3Qt5u9Kubp99z5bvR6Xf/vsppuJagycSOnxb3194?=
 =?us-ascii?Q?uLpJaaEhE1TYgFfjKuPnQyb0O7C0FqLHEwKDR4MxhWRMA/YTPfuryBrz3ZtM?=
 =?us-ascii?Q?Uf4hapfrDEHJU43v3sJlZwkxEreKwZzGz+2EiYaxtWU8KAa6pFHso70zT+RE?=
 =?us-ascii?Q?Wd7TCw3JCBDYS/qkxSw1G/ZkpjgFCbUXrfQFpJDSGgojXs+mgXL71JQ9hm7D?=
 =?us-ascii?Q?ffd3Y1AtW5P84uXDRDdRe/HCWeMhS7cDQAdmtP8A50M1QFHJ/Wdc6lHokGw4?=
 =?us-ascii?Q?Epc/6UM7/7APrqY2QNj932iR7iFlo5FfKwruuP7Fac61/uHj02xafFxFczK6?=
 =?us-ascii?Q?F3TO65899orVlBoGjNThtOhKoCKxZFR7/kUu/1bgT1BSmFw6qdcOCEfBkThS?=
 =?us-ascii?Q?Nhcou/RHijDlSdUBJtGdBIgTmOZd6NXghKWdnQPxcrBHNjkNKMZZRofeknes?=
 =?us-ascii?Q?EcGAwPmYR+M3RL2QqSpeUdAGWYwa921yhoydONfVhUzfOJnaXkMYdck2yHKz?=
 =?us-ascii?Q?uhqxPXqelH4rgXCrU8oCDalIfTIgOSa5NG20UoF8ovKhMnvq948sTiroBB/N?=
 =?us-ascii?Q?HGOnbPzYW8h4ICXx+3j2fh2spsQx03FgVHe3fh9HOcwlCx3Nxj9fshp5y5aZ?=
 =?us-ascii?Q?GgLiGnV8KPV0VjPQesjVg1OiGfT6FgHLQ0b7N35KPZ2AJENiuwXYBR6EaXuG?=
 =?us-ascii?Q?uZmAv5purcTmAJ4Tbfcemja1wEAzV5REdcL0bNUYxLWcKM+p80pVKh0OByUF?=
 =?us-ascii?Q?fjE6mhFJ595Ukob1PCwSKL2l9Zxwnu36lgPMCaqqgOAm0I2+LTmUN0YWfaYI?=
 =?us-ascii?Q?pg=3D=3D?=
X-OriginatorOrg: nxp.com
X-MS-Exchange-CrossTenant-Network-Message-Id: d5990eda-9329-4f5b-1ab3-08dc492140d6
X-MS-Exchange-CrossTenant-AuthSource: VI1PR04MB10073.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Mar 2024 21:03:55.1343
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: GdQ5xnyrgczgjZEfD289g5jPPvEruG94lVcVhkS4B7YxpIqkEskfw33ah3qomXxumj4YiujuI4HIRI1Pow7+tCAllO+BaDbL/0wcfql5Zpk=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR04MB6931

Fix function iov_append_ltv crashes because is not reallocating memory
Use util_ltv_push from util.c

[bluetooth]# [NEW] Endpoint /org/bluez/hci0/pac_bcast0
[bluetooth]# Endpoint /local/endpoint/ep0 registered
endpoint.config /org/bluez/hci0/pac_bcast0 /local/endpoint/ep0 48_4_1
[/local/endpoint/ep0] BIG (auto/value): 0
[/local/endpoint/ep0] Enter channel location (value/no): 3
==80806==ERROR: AddressSanitizer: heap-buffer-overflow on
address 0x60200000a8ba at pc 0x561971611e0e bp 0x7ffd45ab1f00
sp 0x7ffd45ab1ef0 WRITE of size 1 at 0x60200000a8ba thread T0
0x561971611e0d in put_u8 src/shared/util.h:254
0x561971611e0d in util_iov_push_u8 src/shared/util.c:534
0x5619715c28f0 in iov_append_ltv client/player.c:3565
0x5619715c28f0 in config_endpoint_channel_location client/player.c:3593
0x5619716226ce in bt_shell_release_prompt src/shared/shell.c:744
0x561971623087 in rl_handler src/shared/shell.c:769

Silviu Florian Barbulescu (1):
  Fix crash in iov_append_ltv function

 client/player.c | 18 +-----------------
 1 file changed, 1 insertion(+), 17 deletions(-)


base-commit: b8ad3490a3507476844d6c6a87b2cb336f7d4eb9
-- 
2.39.2