[PW_SID:1127042] Bluetooth: MGMT: Add length check in confirm_name#434
[PW_SID:1127042] Bluetooth: MGMT: Add length check in confirm_name#434BluezTestBot wants to merge 1 commit into
Conversation
The confirm_name function did not validate the length of the incoming data before accessing the mgmt_cp_confirm_name structure, which could lead to out-of-bounds reads if a short packet was sent. Add a length check at the beginning of the function to ensure the data is at least sizeof(struct mgmt_cp_confirm_name). If the check fails, return MGMT_STATUS_INVALID_PARAMS without accessing the invalid data. Signed-off-by: caitao <caitao@kylinos.cn>
|
CheckPatch |
|
VerifyFixes |
|
VerifySignedoff |
|
GitLint |
|
SubjectPrefix |
|
BuildKernel |
|
CheckAllWarning |
|
CheckSparse |
|
BuildKernel32 |
|
CheckKernelLLVM |
|
TestRunnerSetup |
|
TestRunner_mgmt-tester |
|
TestRunner_mesh-tester |
|
IncrementalBuild |
2 participants
From: caitao caitao@kylinos.cn
The confirm_name function did not validate the length of the incoming
data before accessing the mgmt_cp_confirm_name structure, which could
lead to out-of-bounds reads if a short packet was sent.
Add a length check at the beginning of the function to ensure the data
is at least sizeof(struct mgmt_cp_confirm_name). If the check fails,
return MGMT_STATUS_INVALID_PARAMS without accessing the invalid data.
Signed-off-by: caitao caitao@kylinos.cn
net/bluetooth/mgmt.c | 4 ++++
1 file changed, 4 insertions(+)