[BlueZ, v4 3/9] unit: Add test for sdp-xml type-confusion bug
Bastien Nocera <[email protected]>
| Newsgroups | org.kernel.vger.linux-bluetooth |
|---|---|
| Message-ID | <[email protected]> |
See https://github.com/bluez/bluez/security/advisories/GHSA-7mmr-gwqx-vc34
Co-authored-by: Aisle Research
---
Makefile.am | 1 +
unit/sdp-xml/compute-seq-size-type-confusion.xml | 9 +++++++++
unit/test-sdp-xml.c | 2 ++
3 files changed, 12 insertions(+)
create mode 100644 unit/sdp-xml/compute-seq-size-type-confusion.xml
diff --git a/Makefile.am b/Makefile.am
index 1ecb5e1ddaec..1d5f02b0d362 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -648,6 +648,7 @@ unit_test_sdp_xml_CFLAGS = $(AM_CFLAGS) $(GLIB_CFLAGS) -DTOP_SRCDIR=\""$(srcdir)
unit_test_sdp_xml_CPPFLAGS = -I$(srcdir)/lib
EXTRA_DIST += unit/sdp-xml/Bluetooth_HID-sdp_record.xml \
+ unit/sdp-xml/compute-seq-size-type-confusion.xml \
unit/sdp-xml/qt-SerialPortSDPRecord.xml
unit_tests += unit/test-avdtp
diff --git a/unit/sdp-xml/compute-seq-size-type-confusion.xml b/unit/sdp-xml/compute-seq-size-type-confusion.xml
new file mode 100644
index 000000000000..41d6478af276
--- /dev/null
+++ b/unit/sdp-xml/compute-seq-size-type-confusion.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<record>
+<attribute id="0x0001">
+<sequence>
+<attribute id="0x0002"><uint8 value="0x01"/></attribute>
+<uint64 value="0x4141414141414141"/>
+</sequence>
+</attribute>
+</record>
diff --git a/unit/test-sdp-xml.c b/unit/test-sdp-xml.c
index 9af2f8c870f6..c8288ca10b8b 100644
--- a/unit/test-sdp-xml.c
+++ b/unit/test-sdp-xml.c
@@ -80,6 +80,8 @@ int main(int argc, char *argv[])
DEFINE_TEST("Bluetooth_HID-sdp_record.xml", TRUE);
DEFINE_TEST("qt-SerialPortSDPRecord.xml", TRUE);
+ /* From https://github.com/bluez/bluez/security/advisories/GHSA-7mmr-gwqx-vc34 */
+ DEFINE_TEST("compute-seq-size-type-confusion.xml", FALSE);
return tester_run();
}
--
2.55.0