[bluez/bluez] 61b2d3: avrcp: Fix Out-of-Bounds Read in AVRCP GetFolderIt...
hadess <[email protected]>
| Newsgroups | org.kernel.vger.linux-bluetooth |
|---|---|
| Message-ID | <bluez/bluez/push/refs/heads/1146125/[email protected]> |
Branch: refs/heads/1146125
Home: https://github.com/bluez/bluez
Commit: 61b2d375a947505bc631618cec5dd82a67319eae
https://github.com/bluez/bluez/commit/61b2d375a947505bc631618cec5dd82a67319eae
Author: Bastien Nocera <[email protected]>
Date: 2026-08-14 (Fri, 14 Aug 2026)
Changed paths:
M profiles/audio/avrcp.c
Log Message:
-----------
avrcp: Fix Out-of-Bounds Read in AVRCP GetFolderItems parsing
If the "Displayable Name Length" is much longer than the size of the PDU
packet we receive, then we might try to memcpy() past the end of the PDU
packet.
Be careful about clamping the name copying to the smallest of:
- length specified in the PDU
- left-over packet after the length field
- size of the string we'll copy it into
Reported-by: Elman Shahbazov <[email protected]>
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications