bt: use size_t type for length parameters instead of signed int
PATCH 1/1 bt: use size_t type for length parameters instead of signed int
From: Prasad J Pandit <[email protected]>
The length parameter values are not negative, thus use an unsigned type 'size_t' for them. Many routines pass 'len' values to memcpy(3) calls. If it was negative, it could lead to memory corruption issues.
--- bt-host.c | 6 ++--- bt-vhci.c | 4 +-- hw/bt/core.c | 2 +- hw/bt/hci-csr.c | 16 ++++++------ hw/bt/hci.c | 38 ++++++++++++++-------------- hw/bt/hid.c | 8 +++--- hw/bt/l2cap.c | 56 ++++++++++++++++++++++-------------------- hw/bt/sdp.c | 6 ++--- hw/usb/dev-bluetooth.c | 6 ++--- include/hw/bt.h | 8 +++--- include/sysemu/bt.h | 10 ++++---- 11 files changed, 81 insertions(+), 79 deletions(-)
This change is similar to
-> https://lists.gnu.org/archive/html/qemu-devel/2018-10/msg02402.html
bt-host.c +3 -3
@@ -63,17 +63,17 @@ static void bt_host_send(struct HCIInfo *hci, } } -static void bt_host_cmd (struct HCIInfo *hci,const uint8_t *data,int len) +static void bt_host_cmd (struct HCIInfo *hci,const uint8_t *data,size_t len) {bt_host_send (hci,HCI_COMMAND_PKT , data, len); } -static void bt_host_acl (struct HCIInfo *hci,const uint8_t *data,int len) +static void bt_host_acl (struct HCIInfo *hci,const uint8_t *data,size_t len) {bt_host_send (hci,HCI_ACLDATA_PKT , data, len); } -static void bt_host_sco (struct HCIInfo *hci,const uint8_t *data,int len) +static void bt_host_sco (struct HCIInfo *hci,const uint8_t *data,size_t len) {bt_host_send (hci,HCI_SCODATA_PKT , data, len); }
bt-vhci.c +2 -2
@@ -125,13 +125,13 @@ static void vhci_host_send(void *opaque, }static void vhci_out_hci_packet_event (void *opaque, -const uint8_t *data,int len) +const uint8_t *data,size_t len) {vhci_host_send (opaque,HCI_EVENT_PKT , data, len); }static void vhci_out_hci_packet_acl (void *opaque, -const uint8_t *data,int len) +const uint8_t *data,size_t len) {vhci_host_send (opaque,HCI_ACLDATA_PKT , data, len); }
hw/bt/core.c +1 -1
@@ -45,7 +45,7 @@ static void bt_dummy_lmp_disconnect_master(struct bt_link_s *link) }static void bt_dummy_lmp_acl_resp (struct bt_link_s *link, -const uint8_t *data,int start,int len) +const uint8_t *data,int start,size_t len) {error_report ("%s: stray ACL response PDU, fixme" , __func__);exit (-1 );
hw/bt/hci-csr.c +8 -8
@@ -103,7 +103,7 @@ static inline void csrhci_fifo_wake(struct csrhci_s *s) }#define csrhci_out_packetz (s, len) memset(csrhci_out_packet(s, len), 0, len) -static uint8_t *csrhci_out_packet (struct csrhci_s *s,int len) +static uint8_t *csrhci_out_packet (struct csrhci_s *s,size_t len) {int off = s->out_start + s->out_len;
@@ -112,14 +112,14 @@ static uint8_t *csrhci_out_packet(struct csrhci_s *s, int len)if (off <FIFO_LEN ) {if (off + len >FIFO_LEN && (s->out_size = off + len) >FIFO_LEN *2 ) { -error_report ("%s: can't alloc %i bytes" , __func__, len); +error_report ("%s: can't alloc %zu bytes" , __func__, len);exit (-1 ); }return s->outfifo + off; }if (s->out_len > s->out_size) { -error_report ("%s: can't alloc %i bytes" , __func__, len); +error_report ("%s: can't alloc %zu bytes" , __func__, len);exit (-1 ); }
@@ -127,7 +127,7 @@ static uint8_t *csrhci_out_packet(struct csrhci_s *s, int len) }static inline uint8_t *csrhci_out_packet_csr (struct csrhci_s *s, -int type,int len) +int type,size_t len) {uint8_t *ret =csrhci_out_packetz (s, len +2 );
@@ -138,7 +138,7 @@ static inline uint8_t *csrhci_out_packet_csr(struct csrhci_s *s, }static inline uint8_t *csrhci_out_packet_event (struct csrhci_s *s, -int evt,int len) +int evt,size_t len) {uint8_t *ret =csrhci_out_packetz (s, len +1 +sizeof (struct hci_event_hdr ));
@@ -151,7 +151,7 @@ static inline uint8_t *csrhci_out_packet_event(struct csrhci_s *s, }static void csrhci_in_packet_vendor (struct csrhci_s *s,int ocf, -uint8_t *data,int len) +uint8_t *data,size_t len) {int offset;uint8_t *rpkt;
@@ -363,7 +363,7 @@ static int csrhci_write(struct Chardev *chr, }static void csrhci_out_hci_packet_event (void *opaque, -const uint8_t *data,int len) +const uint8_t *data,size_t len) {struct csrhci_s *s = (struct csrhci_s *) opaque;uint8_t *pkt =csrhci_out_packet (s, (len +2 ) & ~1 );/* Align */
@@ -375,7 +375,7 @@ static void csrhci_out_hci_packet_event(void *opaque, }static void csrhci_out_hci_packet_acl (void *opaque, -const uint8_t *data,int len) +const uint8_t *data,size_t len) {struct csrhci_s *s = (struct csrhci_s *) opaque;uint8_t *pkt =csrhci_out_packet (s, (len +2 ) & ~1 );/* Align */
hw/bt/hci.c +19 -19
@@ -32,7 +32,7 @@struct bt_hci_s {uint8_t *(*evt_packet)(void *opaque); -void (*evt_submit)(void *opaque,int len); +void (*evt_submit)(void *opaque,size_t len);void *opaque;uint8_t evt_buf[256 ];
@@ -62,7 +62,7 @@ struct bt_hci_s {struct bt_hci_master_link_s {struct bt_link_s *link;void (*lmp_acl_data)(struct bt_link_s *link, -const uint8_t *data,int start,int len); +const uint8_t *data,int start,size_t len);QEMUTimer *acl_mode_timer; } handle[HCI_HANDLES_MAX ];uint32_t role_bmp;
@@ -434,7 +434,7 @@ static const uint8_t bt_event_reserved_mask[8] = { }; -static void null_hci_send (struct HCIInfo *hci,const uint8_t *data,int len) +static void null_hci_send (struct HCIInfo *hci,const uint8_t *data,size_t len) { }
@@ -452,13 +452,13 @@ struct HCIInfo null_hci = {static inline uint8_t *bt_hci_event_start (struct bt_hci_s *hci, -int evt,int len) +int evt,size_t len) {uint8_t *packet, mask;int mask_byte;if (len >255 ) { -error_report ("%s: HCI event params too long (%ib)" , __func__, len); +error_report ("%s: HCI event params too long (%zub)" , __func__, len);exit (-1 ); }
@@ -475,7 +475,7 @@ static inline uint8_t *bt_hci_event_start(struct bt_hci_s *hci, }static inline void bt_hci_event (struct bt_hci_s *hci,int evt, -void *params,int len) +void *params,size_t len) {uint8_t *packet =bt_hci_event_start (hci, evt, len);
@@ -500,7 +500,7 @@ static inline void bt_hci_event_status(struct bt_hci_s *hci, int status) }static inline void bt_hci_event_complete (struct bt_hci_s *hci, -void *ret,int len) +void *ret,size_t len) {uint8_t *packet =bt_hci_event_start (hci,EVT_CMD_COMPLETE , len +EVT_CMD_COMPLETE_SIZE );
@@ -1477,7 +1477,7 @@ static inline void bt_hci_event_num_comp_pkts(struct bt_hci_s *hci, }static void bt_submit_hci (struct HCIInfo *info, -const uint8_t *data,int length) +const uint8_t *data,size_t length) {struct bt_hci_s *hci =hci_from_info (info);uint16_t cmd;
@@ -1971,7 +1971,7 @@ static void bt_submit_hci(struct HCIInfo *info,break ; short_hci: -error_report ("%s: HCI packet too short (%iB)" , __func__, length); +error_report ("%s: HCI packet too short (%zuB)" , __func__, length);bt_hci_event_status (hci,HCI_INVALID_PARAMETERS );break ; }
@@ -1982,7 +1982,7 @@ static void bt_submit_hci(struct HCIInfo *info,* know that a packet contained the last fragment of the SDU when the next * SDU starts. */ static inline void bt_hci_lmp_acl_data (struct bt_hci_s *hci,uint16_t handle, -const uint8_t *data,int start,int len) +const uint8_t *data,int start,size_t len) {struct hci_acl_hdr *pkt = (void *) hci->acl_buf;
@@ -1990,7 +1990,7 @@ static inline void bt_hci_lmp_acl_data(struct bt_hci_s *hci, uint16_t handle,/* TODO: avoid memcpy'ing */ if (len +HCI_ACL_HDR_SIZE >sizeof (hci->acl_buf)) { -error_report ("%s: can't take ACL packets %i bytes long" , +error_report ("%s: can't take ACL packets %zu bytes long" , __func__, len);return ; }
@@ -2004,7 +2004,7 @@ static inline void bt_hci_lmp_acl_data(struct bt_hci_s *hci, uint16_t handle, }static void bt_hci_lmp_acl_data_slave (struct bt_link_s *btlink, -const uint8_t *data,int start,int len) +const uint8_t *data,int start,size_t len) {struct bt_hci_link_s *link = (struct bt_hci_link_s *) btlink;
@@ -2013,14 +2013,14 @@ static void bt_hci_lmp_acl_data_slave(struct bt_link_s *btlink, }static void bt_hci_lmp_acl_data_host (struct bt_link_s *link, -const uint8_t *data,int start,int len) +const uint8_t *data,int start,size_t len) {bt_hci_lmp_acl_data (hci_from_device (link->host), link->handle, data, start, len); }static void bt_submit_acl (struct HCIInfo *info, -const uint8_t *data,int length) +const uint8_t *data,size_t length) {struct bt_hci_s *hci =hci_from_info (info);uint16_t handle;
@@ -2028,7 +2028,7 @@ static void bt_submit_acl(struct HCIInfo *info,struct bt_link_s *link;if (length <HCI_ACL_HDR_SIZE ) { -error_report ("%s: ACL packet too short (%iB)" , __func__, length); +error_report ("%s: ACL packet too short (%zuB)" , __func__, length);return ; }
@@ -2046,7 +2046,7 @@ static void bt_submit_acl(struct HCIInfo *info, handle &= ~HCI_HANDLE_OFFSET ;if (datalen > length) { -error_report ("%s: ACL packet too short (%iB < %iB)" , +error_report ("%s: ACL packet too short (%zuB < %iB)" , __func__, length, datalen);return ; }
@@ -2088,7 +2088,7 @@ static void bt_submit_acl(struct HCIInfo *info, }static void bt_submit_sco (struct HCIInfo *info, -const uint8_t *data,int length) +const uint8_t *data,size_t length) {struct bt_hci_s *hci =hci_from_info (info);uint16_t handle;
@@ -2107,7 +2107,7 @@ static void bt_submit_sco(struct HCIInfo *info, }if (datalen > length) { -error_report ("%s: SCO packet too short (%iB < %iB)" , +error_report ("%s: SCO packet too short (%zuB < %iB)" , __func__, length, datalen);return ; }
@@ -2128,7 +2128,7 @@ static uint8_t *bt_hci_evt_packet(void *opaque)return s->evt_buf; } -static void bt_hci_evt_submit (void *opaque,int len) +static void bt_hci_evt_submit (void *opaque,size_t len) {/* TODO: notify upper layer */ struct bt_hci_s *s = opaque;
hw/bt/hid.c +4 -4
@@ -169,7 +169,7 @@ static void bt_hid_disconnect(struct bt_hid_device_s *s) }static void bt_hid_send_data (struct bt_l2cap_conn_params_s *ch,int type, -const uint8_t *data,int len) +const uint8_t *data,size_t len) {uint8_t *pkt, hdr = (BT_DATA <<4 ) | type;int plen;
@@ -190,7 +190,7 @@ static void bt_hid_send_data(struct bt_l2cap_conn_params_s *ch, int type, }static void bt_hid_control_transaction (struct bt_hid_device_s *s, -const uint8_t *data,int len) +const uint8_t *data,size_t len) {uint8_t type, parameter;int rlen, ret =-1 ;
@@ -362,7 +362,7 @@ static void bt_hid_control_transaction(struct bt_hid_device_s *s,bt_hid_send_handshake (s, ret); } -static void bt_hid_control_sdu (void *opaque,const uint8_t *data,int len) +static void bt_hid_control_sdu (void *opaque,const uint8_t *data,size_t len) {struct bt_hid_device_s *hid = opaque;
@@ -388,7 +388,7 @@ static void bt_hid_datain(HIDState *hs) hid->datain.buffer, hid->datain.len); } -static void bt_hid_interrupt_sdu (void *opaque,const uint8_t *data,int len) +static void bt_hid_interrupt_sdu (void *opaque,const uint8_t *data,size_t len) {struct bt_hid_device_s *hid = opaque;
hw/bt/l2cap.c +29 -27
202 lines not on this page · raw message
hw/bt/sdp.c +3 -3
@@ -497,7 +497,7 @@ static ssize_t sdp_svc_search_attr_get(struct bt_l2cap_sdp_state_s *sdp,return end +2 ; } -static void bt_l2cap_sdp_sdu_in (void *opaque,const uint8_t *data,int len) +static void bt_l2cap_sdp_sdu_in (void *opaque,const uint8_t *data,size_t len) {struct bt_l2cap_sdp_state_s *sdp = opaque;enum bt_sdp_cmd pdu_id;
@@ -507,7 +507,7 @@ static void bt_l2cap_sdp_sdu_in(void *opaque, const uint8_t *data, int len)int rsp_len =0 ;if (len <5 ) { -error_report ("%s: short SDP PDU (%iB)." , __func__, len); +error_report ("%s: short SDP PDU (%zuB)." , __func__, len);return ; }
@@ -518,7 +518,7 @@ static void bt_l2cap_sdp_sdu_in(void *opaque, const uint8_t *data, int len) len -=5 ;if (len != plen) { -error_report ("%s: wrong SDP PDU length (%iB != %iB)." , +error_report ("%s: wrong SDP PDU length (%iB != %zuB)." , __func__, plen, len); err =SDP_INVALID_PDU_SIZE ; goto respond;
hw/usb/dev-bluetooth.c +3 -3
@@ -319,7 +319,7 @@ static inline void usb_bt_fifo_dequeue(struct usb_hci_in_fifo_s *fifo,static inline void usb_bt_fifo_out_enqueue (struct USBBtState *s,struct usb_hci_out_fifo_s *fifo, -void (*send)(struct HCIInfo *,const uint8_t *,int ), +void (*send)(struct HCIInfo *,const uint8_t *,size_t ),int (*complete)(const uint8_t *,int ),USBPacket *p) {
@@ -478,7 +478,7 @@ static void usb_bt_handle_data(USBDevice *dev, USBPacket *p) }static void usb_bt_out_hci_packet_event (void *opaque, -const uint8_t *data,int len) +const uint8_t *data,size_t len) {struct USBBtState *s = (struct USBBtState *) opaque;
@@ -489,7 +489,7 @@ static void usb_bt_out_hci_packet_event(void *opaque, }static void usb_bt_out_hci_packet_acl (void *opaque, -const uint8_t *data,int len) +const uint8_t *data,size_t len) {struct USBBtState *s = (struct USBBtState *) opaque;
include/hw/bt.h +4 -4
@@ -94,9 +94,9 @@ struct bt_device_s {void (*lmp_disconnect_master)(struct bt_link_s *link);void (*lmp_disconnect_slave)(struct bt_link_s *link);void (*lmp_acl_data)(struct bt_link_s *link,const uint8_t *data, -int start,int len); +int start,size_t len);void (*lmp_acl_resp)(struct bt_link_s *link,const uint8_t *data, -int start,int len); +int start,size_t len);void (*lmp_mode_change)(struct bt_link_s *link);void (*handle_destroy)(struct bt_device_s *device);
@@ -148,12 +148,12 @@ struct bt_l2cap_device_s {struct bt_l2cap_conn_params_s {/* Input */ -uint8_t *(*sdu_out)(struct bt_l2cap_conn_params_s *chan,int len); +uint8_t *(*sdu_out)(struct bt_l2cap_conn_params_s *chan,size_t len);void (*sdu_submit)(struct bt_l2cap_conn_params_s *chan);int remote_mtu;/* Output */ void *opaque; -void (*sdu_in)(void *opaque,const uint8_t *data,int len); +void (*sdu_in)(void *opaque,const uint8_t *data,size_t len);void (*close)(void *opaque); };
include/sysemu/bt.h +5 -5
@@ -5,12 +5,12 @@struct HCIInfo {int (*bdaddr_set)(struct HCIInfo *hci,const uint8_t *bd_addr); -void (*cmd_send)(struct HCIInfo *hci,const uint8_t *data,int len); -void (*sco_send)(struct HCIInfo *hci,const uint8_t *data,int len); -void (*acl_send)(struct HCIInfo *hci,const uint8_t *data,int len); +void (*cmd_send)(struct HCIInfo *hci,const uint8_t *data,size_t len); +void (*sco_send)(struct HCIInfo *hci,const uint8_t *data,size_t len); +void (*acl_send)(struct HCIInfo *hci,const uint8_t *data,size_t len);void *opaque; -void (*evt_recv)(void *opaque,const uint8_t *data,int len); -void (*acl_recv)(void *opaque,const uint8_t *data,int len); +void (*evt_recv)(void *opaque,const uint8_t *data,size_t len); +void (*acl_recv)(void *opaque,const uint8_t *data,size_t len); };/* bt-host.c */
Signature · 1 line
2.17.2
Quoted 5 lines · P J P
From: Prasad J Pandit <[email protected]>
The length parameter values are not negative, thus use an unsigned type '
size_t' for them. Many routines pass 'len' values to memcpy(3) calls. If it was negative, it could lead to memory corruption issues.
You are not fixing anything here; if the length was negative before, it would still overflow and it would now be a huge positive value.
So you have to first find out all places where something is subtracted from the length, and ensure it's okay or add assertions.
Then you have to check a much more important issue: places that use a fixed-size buffer such as vhci_host_send should range check len first, again with an assertion if needed.
Only then it makes sense to use size_t.
Paolo
+-- On Thu, 18 Oct 2018, Paolo Bonzini wrote --+ | So you have to first find out all places where something is subtracted | from the length, and ensure it's okay or add assertions. | | Then you have to check a much more important issue: places that use a | fixed-size buffer such as vhci_host_send should range check len first, again | with an assertion if needed.
Okay. There are routines which range check 'len', checking others.
Thank you.
--
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F