*** Fixed heap-buffer-overflow in `compute_seq_size` ***
Get series with b4
b4 am [email protected]Versions newest first
- v1 Latest1 patch 4 repliesIn review
Patches in v1 No applies recorded yet
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/1 | Fixed heap-buffer-overflow in `compute_seq_size`.src/ | +14 | 4 replies |
Reviews trailers per patch
No Reviewed-by, Acked-by or Tested-by trailers for v1 yet.
Cover letter [PATCH BlueZ 0/1] *** Fixed heap-buffer-overflow in `compute_seq_size` ***
The change from the last patch I submitted is the removal of the memory leak fix. This patch focuses on fixing the buffer overflow.
This fixes an ASan crash discovered by OSS-Fuzz:
```
==402==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x502000000218 at pc 0x564763e67877 bp 0x7ffc1a9f92b0 sp 0x7ffc1a9f92a8
READ of size 4 at 0x502000000218 thread T0
#0 0x564763e67876 in compute_seq_size bluez/src/sdp-xml.c:62:21
#1 0x564763e67876 in element_end bluez/src/sdp-xml.c:548:42
#2 0x564763ea5416 in emit_end_element glib/glib/gmarkup.c:1045:5
#3 0x564763ea4978 in g_markup_parse_context_parse glib/glib/gmarkup.c:1603:19
#4 0x564763e65c55 in sdp_xml_parse_record bluez/src/sdp-xml.c:621:6
#5 0x564763e6acf1 in LLVMFuzzerTestOneInput /src/fuzz_xml.c:30:9
#6 0x564763d1a730 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13
#7 0x564763d059a5 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6
#8 0x564763d0b43f in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9
#9 0x564763d366e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
#10 0x79ed69692082 in __libc_start_main /build/glibc-LcI20x/glibc-2.31/csu/libc-start.c:308:16
#11 0x564763cfdb8d in _start
```Oliver Chang (1):
Fixed heap-buffer-overflow in compute_seq_size.
src/sdp-xml.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
Signature · 1 line
2.50.1.703.g449372360f-goog