Re: [BlueZ, v4] avrcp: Fix Out-of-Bounds Read in AVRCP GetFolderItems parsing
Bastien Nocera <[email protected]>
| Newsgroups | org.kernel.vger.linux-bluetooth |
|---|---|
| Message-ID | <[email protected]> |
The security issue that this fixes got assigned CVE-2026-75032. Distributors that want to fix CVE-2026-75032 should also consider applying "avrcp: Fix media/folder name not being set", which is still pending. On Fri, 2026-08-14 at 17:20 +0000, [email protected] wrote: > Hello: > > This patch was applied to bluetooth/bluez.git (master) > by Luiz Augusto von Dentz <[email protected]>: > > On Fri, 14 Aug 2026 16:01:18 +0200 you wrote: > > If the "Displayable Name Length" is much longer than the size of > > the PDU > > packet we receive, then we might try to memcpy() past the end of > > the PDU > > packet. > > > > Be careful about clamping the name copying to the smallest of: > > - length specified in the PDU > > - left-over packet after the length field > > - size of the string we'll copy it into > > > > [...] > > Here is the summary with links: > - [BlueZ,v4] avrcp: Fix Out-of-Bounds Read in AVRCP GetFolderItems > parsing > > https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=bd8989620ed6 > > You are awesome, thank you!