Re: [PATCH BlueZ v1 1/8] eir: Fix stack buffer overflow when parsing the remote name

On Thu, 2026-08-20 at 09:46 +0200, Bastien Nocera wrote:
> On Wed, 2026-08-19 at 16:40 -0400, Luiz Augusto von Dentz wrote:
> > From: Luiz Augusto von Dentz <[email protected]>
> > 
> > name2utf8() copies len bytes into a HCI_MAX_NAME_LENGTH + 2, so
> > 250,
> > byte stack buffer without clamping len first.
> > 
> > eir_parse() only rejects a field once it runs past the end of the
> > EIR
> > data, and that data is up to 255 bytes, so field_len can be 254 and
> > the
> > data_len passed to name2utf8() can reach 253. strncpy() then writes
> > 253
> > bytes into the 250 byte buffer and leaves it unterminated, so the
> > following g_strstrip() and g_strdup() also read past the end.
> > 
> > The EIR data comes from a remote device, either in an extended
> > inquiry
> > response or in an advertising report, so the length is attacker
> > controlled.
> > 
> > Clamp len like the other name2utf8() copies already do. Parsing a
> > 253
> > byte EIR_NAME_COMPLETE field returned a 253 byte name before this
> > change, and returns a 249 byte one after it.
> 
> This issue was embargoed, and this commit is the exact same one I
> sent
> privately to fix that issue.
> 
> It would be nice to have either the authored-by or co-authored by
> tag.
> Could you please also make sure to add:
> "
> Reported-by: @sprabhav7 (Prabhav S)
> 
> See:
> https://github.com/bluez/bluez/security/advisories/GHSA-68h6-5qgp-3975
> "
> 
> To the commit message. I'll work on the security advisory to get it
> published.

I've also attached below a test case for the issue at hand. It should
probably be using name2utf8() first, then be adapted like the other
users were in "Replace the name2utf8 copies with str2utf8".

From 6664a7b7ff9a1ae9045b64c834179895afe720bf Mon Sep 17 00:00:00 2001
From: Bastien Nocera <[email protected]>
Date: Wed, 12 Aug 2026 11:55:33 +0200
Subject: [PATCH] unit: Add name2utf8() test

Co-authored-by: @sprabhav7 (Prabhav S)

See: https://github.com/bluez/bluez/security/advisories/GHSA-68h6-5qgp-3975
---
 unit/test-eir.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/unit/test-eir.c b/unit/test-eir.c
index a4b6743e48b7..b51a5e1d65b0 100644
--- a/unit/test-eir.c
+++ b/unit/test-eir.c
@@ -701,6 +701,22 @@ static void test_parsing(gconstpointer data)
 	tester_test_passed();
 }
 
+#define TRUNCATED_NAME "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+
+static void test_name2utf8(const void *data)
+{
+	uint8_t name_len = 253;
+	uint8_t malicious_name[name_len];
+	char *ret = NULL;
+
+	memset(malicious_name, 'A', sizeof(malicious_name));
+	ret = str2utf8(malicious_name, name_len);
+	g_assert_cmpstr(ret, ==, TRUNCATED_NAME);
+	g_free (ret);
+
+	tester_test_passed();
+}
+
 static const unsigned char gigaset_gtag_data[] = {
 		0x02, 0x01, 0x06, 0x0d, 0xff, 0x80, 0x01, 0x02,
 		0x15, 0x12, 0x34, 0x80, 0x91, 0xd0, 0xf2, 0xbb,
@@ -743,6 +759,7 @@ int main(int argc, char *argv[])
 	tester_init(&argc, &argv);
 
 	tester_add("/eir/basic", NULL, NULL, test_basic, NULL);
+	tester_add("/eir/name2utf8", NULL, NULL, test_name2utf8, NULL);
 
 	tester_add("/eir/macbookair", &macbookair_test, NULL, test_parsing,
 									NULL);
-- 
2.55.0