[PATCH] Bluetooth: hci_codec: validate vendor codec count length
Laxman Acharya Padhya <[email protected]>
| Newsgroups | org.kernel.vger.linux-bluetooth,org.kernel.vger.linux-kernel,org.kernel.vger.stable |
|---|---|
| Message-ID | <[email protected]> |
The Read Local Supported Codecs parsers consume the variable-sized
standard codec array before parsing the vendor codec count. Although the
initial reply-size check includes a vendor count byte in the fixed layout,
it does not guarantee that the byte remains after the standard codec array.
If a controller reply ends immediately after that array, calculating the
vendor codec array size reads vnd_codecs->num beyond the skb data. Require
the vendor codec header to be present before using its count in both
command variants.
Fixes: 8961987f3f5f ("Bluetooth: Enumerate local supported codec and cache details")
Fixes: 9ae664028a9e ("Bluetooth: Add support for Read Local Supported Codecs V2")
Cc: [email protected]
Signed-off-by: Laxman Acharya Padhya <[email protected]>
---
net/bluetooth/hci_codec.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/bluetooth/hci_codec.c b/net/bluetooth/hci_codec.c
index 5bc5003c387c..99394a3348c7 100644
--- a/net/bluetooth/hci_codec.c
+++ b/net/bluetooth/hci_codec.c
@@ -165,6 +165,8 @@ void hci_read_supported_codecs(struct hci_dev *hdev)
+ sizeof(std_codecs->num));
vnd_codecs = (void *)skb->data;
+ if (skb->len < sizeof(*vnd_codecs))
+ goto error;
/* validate vendor codecs length before accessing */
if (skb->len <
@@ -233,6 +235,8 @@ void hci_read_supported_codecs_v2(struct hci_dev *hdev)
+ sizeof(std_codecs->num));
vnd_codecs = (void *)skb->data;
+ if (skb->len < sizeof(*vnd_codecs))
+ goto error;
/* check for payload data length before accessing */
if (skb->len <
--
2.50.1