diff mbox series

[BlueZ] shared/gatt-db: Fix munmap_chunk invalid pointer

Message ID 20240103092816.22952-1-frederic.danis@collabora.com
State New
Headers show
Series [BlueZ] shared/gatt-db: Fix munmap_chunk invalid pointer | expand

Commit Message

Frédéric Danis Jan. 3, 2024, 9:28 a.m. UTC 
PTS test GATT/CL/GAD/BV-03-C published a service starting at handle 0xfffd
and ending at 0xffff.
This resets the next_handle to 0 in gatt_db_insert_service() instead of
setting it to 0x10000. Other services are added later.
This could end-up by a crash in db_hash_update() if not enough space has
been allocated for hash.iov and some entries are overwritten.
---
 src/shared/gatt-db.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/src/shared/gatt-db.c b/src/shared/gatt-db.c
index 676f963ec..d32c9a70f 100644
--- a/src/shared/gatt-db.c
+++ b/src/shared/gatt-db.c
@@ -58,7 +58,7 @@  struct gatt_db {
 	struct bt_crypto *crypto;
 	uint8_t hash[16];
 	unsigned int hash_id;
-	uint16_t next_handle;
+	uint32_t next_handle;
 	struct queue *services;
 
 	struct queue *notify_list;