From ba1d6936f6f83927f17a28ecc9cbb989fa0a7e34 Mon Sep 17 00:00:00 2001 From: Johan Hedberg Date: Thu, 3 Jul 2014 13:52:27 +0300 Subject: [PATCH] Bluetooth: Fix buffer overflow with variable length commands The handler for variable length commands were trying to calculate the expected length of the command based on the given parameter count, and then comparing that with the received data. However, the expected count was stored in a u16 which can easily overflow. With a carefully crafted command this can then be made to match the given data even though the parameter count is actually way too big, resulting in a buffer overflow when parsing the parameters. This patch fixes the issue by calculating a per-command maximum parameter count and returns INVALID_PARAMS if it is exceeded. Signed-off-by: Johan Hedberg Signed-off-by: Marcel Holtmann --- Reading git-format-patch failed