btmon: fix segfault caused by integer underflow Fix segfault caused by integer underflow in decode_data_element function of monitor/sdp.c. Fix is to check that elemlen is not bigger than size before subtracting elemlen from size. Also search_bytes + attr_bytes should not be bigger than frame->size. This bug can be triggered locally reading malformed btmon capture file and also over the air by sending specifically crafted SDP Search Attribute response to device running btmon. This bug was found by fuzzing btmon with AFL.

Diffstat

1 files changed, 10 insertions(+), 0 deletions(-)