summaryrefslogtreecommitdiff
path: root/lib/libbluetooth
diff options
context:
space:
mode:
authorplunky <plunky@NetBSD.org>2011-04-05 18:19:04 +0000
committerplunky <plunky@NetBSD.org>2011-04-05 18:19:04 +0000
commitfcc47fccb1bf32c4d5faf4a8dc8dd34ff38416bf (patch)
tree45aa6bb7eec4ffec7845e1ea3225e142cec7419e /lib/libbluetooth
parentd40bb8a08b6edd71315f82d87c82615b07ee9731 (diff)
Don't add the passed in 'len' value while testing if the data
space is large enough, to handle the edge case where len is large (up to SSIZE_MAX may be valid on some machines) causing pointers to wrap around and the fail condition to be missed.
Diffstat (limited to 'lib/libbluetooth')
-rw-r--r--lib/libbluetooth/sdp_put.c12
-rw-r--r--lib/libbluetooth/sdp_set.c10
2 files changed, 11 insertions, 11 deletions
diff --git a/lib/libbluetooth/sdp_put.c b/lib/libbluetooth/sdp_put.c
index bd405145db0..6cb96ed50b9 100644
--- a/lib/libbluetooth/sdp_put.c
+++ b/lib/libbluetooth/sdp_put.c
@@ -1,4 +1,4 @@
-/* $NetBSD: sdp_put.c,v 1.4 2011/04/04 19:51:33 plunky Exp $ */
+/* $NetBSD: sdp_put.c,v 1.5 2011/04/05 18:19:04 plunky Exp $ */
/*-
* Copyright (c) 2009 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
*/
#include <sys/cdefs.h>
-__RCSID("$NetBSD: sdp_put.c,v 1.4 2011/04/04 19:51:33 plunky Exp $");
+__RCSID("$NetBSD: sdp_put.c,v 1.5 2011/04/05 18:19:04 plunky Exp $");
#include <bluetooth.h>
#include <limits.h>
@@ -51,7 +51,7 @@ sdp_put_data(sdp_data_t *data, sdp_data_t *value)
len = value->end - value->next;
- if (data->next + len > data->end)
+ if (len > data->end - data->next)
return false;
memcpy(data->next, value->next, (size_t)len);
@@ -304,21 +304,21 @@ _sdp_put_ext(uint8_t type, sdp_data_t *data, ssize_t len)
return false;
if ((size_t)len > UINT16_MAX) {
- if (p + 5 + len > data->end)
+ if (len > data->end - 5 - p)
return false;
p[0] = type | SDP_DATA_EXT32;
be32enc(p + 1, (uint32_t)len);
p += 5;
} else if ((size_t)len > UINT8_MAX) {
- if (p + 3 + len > data->end)
+ if (len > data->end - 3 - p)
return false;
p[0] = type | SDP_DATA_EXT16;
be16enc(p + 1, (uint16_t)len);
p += 3;
} else {
- if (p + 2 + len > data->end)
+ if (len > data->end - 2 - p)
return false;
p[0] = type | SDP_DATA_EXT8;
diff --git a/lib/libbluetooth/sdp_set.c b/lib/libbluetooth/sdp_set.c
index 0d7d557e3c9..54b61c1f64a 100644
--- a/lib/libbluetooth/sdp_set.c
+++ b/lib/libbluetooth/sdp_set.c
@@ -1,4 +1,4 @@
-/* $NetBSD: sdp_set.c,v 1.2 2009/05/14 19:12:45 plunky Exp $ */
+/* $NetBSD: sdp_set.c,v 1.3 2011/04/05 18:19:04 plunky Exp $ */
/*-
* Copyright (c) 2009 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
*/
#include <sys/cdefs.h>
-__RCSID("$NetBSD: sdp_set.c,v 1.2 2009/05/14 19:12:45 plunky Exp $");
+__RCSID("$NetBSD: sdp_set.c,v 1.3 2011/04/05 18:19:04 plunky Exp $");
#include <bluetooth.h>
#include <limits.h>
@@ -187,7 +187,7 @@ _sdp_set_ext(uint8_t type, const sdp_data_t *data, ssize_t len)
return false;
len = data->end - p - 1;
- } else if (p + 1 + len > data->end)
+ } else if (len > data->end - 1 - p)
return false;
if (len > UINT8_MAX)
@@ -202,7 +202,7 @@ _sdp_set_ext(uint8_t type, const sdp_data_t *data, ssize_t len)
return false;
len = data->end - p - 2;
- } else if (p + 2 + len > data->end)
+ } else if (len > data->end - 2 - p)
return false;
if (len > UINT16_MAX)
@@ -217,7 +217,7 @@ _sdp_set_ext(uint8_t type, const sdp_data_t *data, ssize_t len)
return false;
len = data->end - p - 4;
- } else if (p + 4 + len > data->end)
+ } else if (len > data->end - 4 - p)
return false;
if ((size_t)len > UINT32_MAX)