Attachment 310417 Details for Bug 452715 – Patch for bluez-utils 2.10 (RHEL-4)

[patch] Patch for bluez-utils 2.10 (RHEL-4)

bluez-utils-2.10-sdp-vuln.patch (text/plain), 7.87 KB, created by Bastien Nocera on 2008-06-27 09:38:02 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Bastien Nocera

Created: 2008-06-27 09:38:02 UTC

Size: 7.87 KB

patch

obsolete

>diff -upr bluez-utils-2.10/sdpd/request.c bluez-utils-2.10.new/sdpd/request.c
>--- bluez-utils-2.10/sdpd/request.c	2004-06-17 12:05:36.000000000 -0400
>+++ bluez-utils-2.10.new/sdpd/request.c	2008-06-27 05:32:19.000000000 -0400
>@@ -56,17 +56,20 @@
>  * sequence. The data type of elements found in the
>  * sequence is returned in the reference pDataType
>  */
>-static int extract_des(char *buf, sdp_list_t **svcReqSeq, uint8_t *pDataType, uint8_t expectedType)
>+static int extract_des(char *buf, int len, sdp_list_t **svcReqSeq, uint8_t *pDataType, uint8_t expectedType)
> {
> 	uint8_t seqType;
> 	int data_size = 0;
>-	int scanned = sdp_extract_seqtype(buf, &seqType, &data_size);
>+	int scanned;
> 	short numberOfElements = 0;
> 	int seqlen = 0;
> 	sdp_list_t *pSeq = NULL;
> 	uint8_t dataType;
> 	int status = 0;
> 	const char *p;
>+	int bufsize;
>+
>+	scanned = sdp_extract_seqtype_safe(buf, len, &seqType, &data_size);
> 
> 	SDPDBG("Seq type : %d\n", seqType);
> 	if (!scanned || (seqType != SDP_SEQ8 && seqType != SDP_SEQ16)) {
>@@ -74,12 +77,18 @@ static int extract_des(char *buf, sdp_li
> 		return -1;
> 	}
> 	p = buf + scanned;
>+	bufsize = len - scanned;
> 
> 	SDPDBG("Data size : %d\n", data_size);
> 	for (;;) {
> 		char *pElem = NULL;
> 		int localSeqLength = 0;
> 
>+		if (bufsize < sizeof(uint8_t)) {
>+			SDPDBG("->Unexpected end of buffer");
>+			return -1;
>+		}
>+
> 		dataType = *(uint8_t *)p;
> 		SDPDBG("Data type: 0x%02x\n", dataType);
> 
>@@ -97,27 +106,42 @@ static int extract_des(char *buf, sdp_li
> 		case SDP_UINT16:
> 			p += sizeof(uint8_t);
> 			seqlen += sizeof(uint8_t);
>+			bufsize -= sizeof(uint8_t);
>+			if (bufsize < sizeof(uint16_t)) {
>+				SDPDBG("->Unexpected end of buffer");
>+				return -1;
>+			}
>+
> 			pElem = (char *)malloc(sizeof(uint16_t));
> 			sdp_put_unaligned(ntohs(sdp_get_unaligned((uint16_t *)p)), (uint16_t *)pElem);
> 			p += sizeof(uint16_t);
> 			seqlen += sizeof(uint16_t);
>+			bufsize -= sizeof(uint16_t);
> 			break;
> 		case SDP_UINT32:
> 			p += sizeof(uint8_t);
> 			seqlen += sizeof(uint8_t);
>+			bufsize -= sizeof(uint8_t);
>+			if (bufsize < (int)sizeof(uint32_t)) {
>+				SDPDBG("->Unexpected end of buffer");
>+				return -1;
>+			}
>+
> 			pElem = (char *)malloc(sizeof(uint32_t));
> 			sdp_put_unaligned(ntohl(sdp_get_unaligned((uint32_t *)p)), (uint32_t *)pElem);
> 			p += sizeof(uint32_t);
> 			seqlen += sizeof(uint32_t);
>+			bufsize -= sizeof(uint32_t);
> 			break;
> 		case SDP_UUID16:
> 		case SDP_UUID32:
> 		case SDP_UUID128:
> 			pElem = (char *)malloc(sizeof(uuid_t));
>-			status = sdp_uuid_extract(p, (uuid_t *)pElem, &localSeqLength);
>+			status = sdp_uuid_extract_safe(p, bufsize, (uuid_t *) pElem, &localSeqLength);
> 			if (status == 0) {
> 				seqlen += localSeqLength;
> 				p += localSeqLength;
>+				bufsize -= localSeqLength;
> 			}
> 			break;
> 		}
>@@ -242,7 +266,7 @@ static int service_search_req(sdp_req_t 
> 	short *pTotalRecordCount, *pCurrentRecordCount;
> 	int mtu;
> 	char *pdata = req->buf + sizeof(sdp_pdu_hdr_t);
>-	int scanned = extract_des(pdata, &pattern, &dtd, SDP_TYPE_UUID);
>+	int scanned = extract_des(pdata, req->len - sizeof(sdp_pdu_hdr_t), &pattern, &dtd, SDP_TYPE_UUID);
> 
> 	SDPDBG("");
> 
>@@ -502,7 +526,7 @@ static int service_attr_req(sdp_req_t *r
> 	pdata += sizeof(uint16_t);
> 
> 	/* extract the attribute list */
>-	scanned = extract_des(pdata, &seq, &dtd, SDP_TYPE_ANY);
>+	scanned = extract_des(pdata, req->len - sizeof(sdp_pdu_hdr_t), &seq, &dtd, SDP_TYPE_ANY);
> 	if (scanned == -1) {
> 		status = SDP_INVALID_SYNTAX;
> 		goto done;
>@@ -614,7 +638,7 @@ static int service_search_attr_req(sdp_r
> 
> 	tmpbuf.data = NULL;
> 	pdata = req->buf + sizeof(sdp_pdu_hdr_t);
>-	scanned = extract_des(pdata, &pattern, &dtd, SDP_TYPE_UUID);
>+	scanned = extract_des(pdata, req->len - sizeof(sdp_pdu_hdr_t), &pattern, &dtd, SDP_TYPE_UUID);
> 	if (scanned == -1) {
>         	status = SDP_INVALID_SYNTAX;
> 		goto done;
>@@ -630,7 +654,7 @@ static int service_search_attr_req(sdp_r
> 	SDPDBG("Max Attr expected: %d", max);
> 
> 	/* extract the attribute list */
>-	scanned = extract_des(pdata, &seq, &dtd, SDP_TYPE_ANY);
>+	scanned = extract_des(pdata, req->len - sizeof(sdp_pdu_hdr_t), &seq, &dtd, SDP_TYPE_ANY);
> 	if (scanned == -1) {
> 		status = SDP_INVALID_SYNTAX;
> 		goto done;
>diff -upr bluez-utils-2.10/sdpd/service.c bluez-utils-2.10.new/sdpd/service.c
>--- bluez-utils-2.10/sdpd/service.c	2004-06-17 12:05:36.000000000 -0400
>+++ bluez-utils-2.10.new/sdpd/service.c	2008-06-27 05:32:48.000000000 -0400
>@@ -45,7 +45,7 @@
> extern void update_db_timestamp(void);
> 
> // FIXME: refactor for server-side
>-static sdp_record_t *extract_pdu_server(char *p, uint32_t handleExpected, int *scanned)
>+static sdp_record_t *extract_pdu_server(bdaddr_t *device, uint8_t *p, int bufsize, uint32_t handleExpected, int *scanned)
> {
> 	int extractStatus = -1, localExtractedLength = 0;
> 	uint8_t dtd;
>@@ -55,13 +55,24 @@ static sdp_record_t *extract_pdu_server(
> 	sdp_data_t *pAttr = NULL;
> 	uint32_t handle = 0xffffffff;
> 
>-	*scanned = sdp_extract_seqtype(p, &dtd, &seqlen);
>+	*scanned = sdp_extract_seqtype_safe(p, bufsize, &dtd, &seqlen);
> 	p += *scanned;
>+	bufsize -= *scanned;
>+
>+	if (bufsize < sizeof(uint8_t) + sizeof(uint8_t)) {
>+		SDPDBG("Unexpected end of packet");
>+		return NULL;
>+	}
>+
> 	lookAheadAttrId = ntohs(sdp_get_unaligned((uint16_t *)(p + sizeof(uint8_t))));
> 
> 	SDPDBG("Look ahead attr id : %d\n", lookAheadAttrId);
> 
> 	if (lookAheadAttrId == SDP_ATTR_RECORD_HANDLE) {
>+		if (bufsize < (sizeof(uint8_t) * 2) + sizeof(uint16_t) + sizeof(uint32_t)) {
>+			SDPDBG("Unexpected end of packet");
>+			return NULL;
>+		}
> 		handle = ntohl(sdp_get_unaligned((uint32_t *)(p +
> 				sizeof(uint8_t) + sizeof(uint16_t) +
> 				sizeof(uint8_t))));
>@@ -86,6 +97,11 @@ static sdp_record_t *extract_pdu_server(
> 		int attrSize = sizeof(uint8_t);
> 		int attrValueLength = 0;
> 
>+		if (bufsize < attrSize + sizeof(uint16_t)) {
>+			SDPDBG("Unexpected end of packet: Terminating extraction of attributes");
>+			break;
>+		}
>+
> 		SDPDBG("Extract PDU, sequenceLength: %d localExtractedLength: %d", seqlen, localExtractedLength);
> 		dtd = *(uint8_t *)p;
> 
>@@ -94,7 +110,8 @@ static sdp_record_t *extract_pdu_server(
> 		
> 		SDPDBG("DTD of attrId : %d Attr id : 0x%x \n", dtd, attrId);
> 
>-		pAttr = sdp_extract_attr(p + attrSize, &attrValueLength, rec);
>+		pAttr = sdp_extract_attr_safe(p + attrSize, bufsize - attrSize,
>+							&attrValueLength, rec);
> 
> 		SDPDBG("Attr id : 0x%x attrValueLength : %d\n", attrId, attrValueLength);
> 
>@@ -105,6 +122,7 @@ static sdp_record_t *extract_pdu_server(
> 		}
> 		localExtractedLength += attrSize;
> 		p += attrSize;
>+		bufsize -= attrSize;
> 		sdp_attr_replace(rec, attrId, pAttr);
> 		extractStatus = 0;
> 		SDPDBG("Extract PDU, seqLength: %d localExtractedLength: %d",
>@@ -129,12 +147,13 @@ int service_register_req(sdp_req_t *req,
> 	int scanned = 0;
> 	sdp_data_t *handle;
> 	char *p = req->buf + sizeof(sdp_pdu_hdr_t);
>+	int bufsize = req->len - sizeof(sdp_pdu_hdr_t);
> 	sdp_record_t *rec;
> 
> 	req->flags = *p++;
> 
> 	// save image of PDU: we need it when clients request this attribute
>-	rec = extract_pdu_server(p, 0xffffffff, &scanned);
>+	rec = extract_pdu_server(BDADDR_ANY, p, bufsize, 0xffffffff, &scanned);
> 	if (rec == NULL) {
> 		sdp_put_unaligned(htons(SDP_INVALID_SYNTAX), (uint16_t *)rsp->data);
> 		rsp->data_size = sizeof(uint16_t);
>@@ -172,6 +191,7 @@ int service_update_req(sdp_req_t *req, s
> 	sdp_record_t *orec;
> 	int status = 0, scanned = 0;
> 	char *p = req->buf + sizeof(sdp_pdu_hdr_t);
>+	int bufsize = req->len - sizeof(sdp_pdu_hdr_t);
> 	uint32_t handle = ntohl(sdp_get_unaligned((uint32_t *)p));
> 
> 	SDPDBG("");
>@@ -179,13 +199,14 @@ int service_update_req(sdp_req_t *req, s
> 	SDPDBG("Svc Rec Handle: 0x%x\n", handle);
> 	
> 	p += sizeof(uint32_t);
>+	bufsize -= sizeof(uint32_t);
> 
> 	orec = sdp_record_find(handle);
> 	
> 	SDPDBG("SvcRecOld: 0x%x\n", (uint32_t)orec);
> 
> 	if (orec) {
>-		sdp_record_t *nrec = extract_pdu_server(p, handle, &scanned);
>+		sdp_record_t *nrec = extract_pdu_server(BDADDR_ANY, p, bufsize, handle, &scanned);
> 		if (nrec && handle == nrec->handle)
> 			update_db_timestamp();
> 		else {

Actions: View | Diff

Attachments on bug 452715: 310163 | 310164 | 310247 | 310250 | 310333 | 310417