diff options
| author | plunky <plunky@NetBSD.org> | 2011-04-05 18:19:04 +0000 |
|---|---|---|
| committer | plunky <plunky@NetBSD.org> | 2011-04-05 18:19:04 +0000 |
| commit | fcc47fccb1bf32c4d5faf4a8dc8dd34ff38416bf (patch) | |
| tree | 45aa6bb7eec4ffec7845e1ea3225e142cec7419e /lib/libbluetooth | |
| parent | d40bb8a08b6edd71315f82d87c82615b07ee9731 (diff) | |
Don't add the passed in 'len' value while testing if the data
space is large enough, to handle the edge case where len is
large (up to SSIZE_MAX may be valid on some machines) causing
pointers to wrap around and the fail condition to be missed.
Diffstat (limited to 'lib/libbluetooth')
| -rw-r--r-- | lib/libbluetooth/sdp_put.c | 12 | ||||
| -rw-r--r-- | lib/libbluetooth/sdp_set.c | 10 |
2 files changed, 11 insertions, 11 deletions
diff --git a/lib/libbluetooth/sdp_put.c b/lib/libbluetooth/sdp_put.c index bd405145db0..6cb96ed50b9 100644 --- a/lib/libbluetooth/sdp_put.c +++ b/lib/libbluetooth/sdp_put.c @@ -1,4 +1,4 @@ -/* $NetBSD: sdp_put.c,v 1.4 2011/04/04 19:51:33 plunky Exp $ */ +/* $NetBSD: sdp_put.c,v 1.5 2011/04/05 18:19:04 plunky Exp $ */ /*- * Copyright (c) 2009 The NetBSD Foundation, Inc. @@ -30,7 +30,7 @@ */ #include <sys/cdefs.h> -__RCSID("$NetBSD: sdp_put.c,v 1.4 2011/04/04 19:51:33 plunky Exp $"); +__RCSID("$NetBSD: sdp_put.c,v 1.5 2011/04/05 18:19:04 plunky Exp $"); #include <bluetooth.h> #include <limits.h> @@ -51,7 +51,7 @@ sdp_put_data(sdp_data_t *data, sdp_data_t *value) len = value->end - value->next; - if (data->next + len > data->end) + if (len > data->end - data->next) return false; memcpy(data->next, value->next, (size_t)len); @@ -304,21 +304,21 @@ _sdp_put_ext(uint8_t type, sdp_data_t *data, ssize_t len) return false; if ((size_t)len > UINT16_MAX) { - if (p + 5 + len > data->end) + if (len > data->end - 5 - p) return false; p[0] = type | SDP_DATA_EXT32; be32enc(p + 1, (uint32_t)len); p += 5; } else if ((size_t)len > UINT8_MAX) { - if (p + 3 + len > data->end) + if (len > data->end - 3 - p) return false; p[0] = type | SDP_DATA_EXT16; be16enc(p + 1, (uint16_t)len); p += 3; } else { - if (p + 2 + len > data->end) + if (len > data->end - 2 - p) return false; p[0] = type | SDP_DATA_EXT8; diff --git a/lib/libbluetooth/sdp_set.c b/lib/libbluetooth/sdp_set.c index 0d7d557e3c9..54b61c1f64a 100644 --- a/lib/libbluetooth/sdp_set.c +++ b/lib/libbluetooth/sdp_set.c @@ -1,4 +1,4 @@ -/* $NetBSD: sdp_set.c,v 1.2 2009/05/14 19:12:45 plunky Exp $ */ +/* $NetBSD: sdp_set.c,v 1.3 2011/04/05 18:19:04 plunky Exp $ */ /*- * Copyright (c) 2009 The NetBSD Foundation, Inc. @@ -30,7 +30,7 @@ */ #include <sys/cdefs.h> -__RCSID("$NetBSD: sdp_set.c,v 1.2 2009/05/14 19:12:45 plunky Exp $"); +__RCSID("$NetBSD: sdp_set.c,v 1.3 2011/04/05 18:19:04 plunky Exp $"); #include <bluetooth.h> #include <limits.h> @@ -187,7 +187,7 @@ _sdp_set_ext(uint8_t type, const sdp_data_t *data, ssize_t len) return false; len = data->end - p - 1; - } else if (p + 1 + len > data->end) + } else if (len > data->end - 1 - p) return false; if (len > UINT8_MAX) @@ -202,7 +202,7 @@ _sdp_set_ext(uint8_t type, const sdp_data_t *data, ssize_t len) return false; len = data->end - p - 2; - } else if (p + 2 + len > data->end) + } else if (len > data->end - 2 - p) return false; if (len > UINT16_MAX) @@ -217,7 +217,7 @@ _sdp_set_ext(uint8_t type, const sdp_data_t *data, ssize_t len) return false; len = data->end - p - 4; - } else if (p + 4 + len > data->end) + } else if (len > data->end - 4 - p) return false; if ((size_t)len > UINT32_MAX) |
