Skip to content

Commit ab14539

Browse files
mkarhumaaJohan Hedberg
authored andcommitted
btmon: fix segfault caused by buffer over-read
Fix segfault caused by buffer over-read. Check that index is not bigger than MAX_INDEX. This bug was found by fuzzing with AFL. Program received signal SIGSEGV, Segmentation fault. 0x0000000000420bb8 in print_packet (tv=<optimized out>, cred=<optimized out>, ident=<optimized out>, index=<optimized out>, channel=<optimized out>, color=<optimized out>, label=<optimized out>, text=<optimized out>, extra=<optimized out>) at monitor/packet.c:317 warning: Source file is more recent than executable. 317 index_list[index].frame != last_frame) { (gdb) bt #0 0x0000000000420bb8 in print_packet (tv=<optimized out>, cred=<optimized out>, ident=<optimized out>, index=<optimized out>, channel=<optimized out>, color=<optimized out>, label=<optimized out>, text=<optimized out>, extra=<optimized out>) at monitor/packet.c:317 #1 0x000000000041a8c3 in packet_new_index (tv=<optimized out>, index=<optimized out>, name=0x7fffffffda68 "rsion 4.18.0-matias-patch2 (x86_64)", label=<optimized out>, type=<optimized out>, bus=<optimized out>) at monitor/packet.c:9818 #2 packet_monitor (tv=0x7fffffffda50, cred=<optimized out>, index=<optimized out>, opcode=<optimized out>, data=0x7fffffffda60, size=<optimized out>) at monitor/packet.c:3881 #3 0x000000000040e177 in control_reader (path=<optimized out>, pager=true) at monitor/control.c:1462 #4 0x0000000000403b00 in main (argc=<optimized out>, argv=<optimized out>) at monitor/main.c:243
1 parent 57b7dea commit ab14539

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

monitor/packet.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -310,7 +310,7 @@ static void print_packet(struct timeval *tv, struct ucred *cred, char ident,
310310
ts_pos += n;
311311
ts_len += n;
312312
}
313-
} else if (index != HCI_DEV_NONE &&
313+
} else if (index != HCI_DEV_NONE && index < MAX_INDEX &&
314314
index_list[index].frame != last_frame) {
315315
if (use_color()) {
316316
n = sprintf(ts_str + ts_pos, "%s", COLOR_FRAME_LABEL);

0 commit comments

Comments
 (0)