From 00eea35722b73d922472c7fba006f711690ce195 Mon Sep 17 00:00:00 2001 From: Oliver Chang Date: Wed, 13 Aug 2025 10:34:59 +0000 Subject: [PATCH] Fix heap-buffer-overflow in sdp_xml.c:compute_seq_size https://issues.oss-fuzz.com/issues/42516062 https://oss-fuzz.com/testcase-detail/5896441415729152 This can be triggered by using an input of `` against the harness in https://github.com/google/oss-fuzz/blob/master/projects/bluez/fuzz_xml.c The root cause of the heap-buffer-overflow was incorrect stack management in the SDP XML parser (element_end function) that led to type confusion. When an XML element failed to parse (e.g., an unrecognized tag like ), its corresponding entry was left on the parser stack because the we returned early if data was NULL. With the input , failed parsing and remained on the stack with a NULL data. Then was parsed and also remained on the stack because it's only popped if ctx_data->stack_head->next->data != NULL. When was encountered, the parser then mistakenly used the data from (which was now at the top of the stack) as the sequence data. This led to a type confusion: the TEXT data's string pointer (val.str) was interpreted as a sequence pointer (val.dataseq). This pointer pointed to a 1-byte allocation (for the empty string). The code then tried to dereference this pointer as an sdp_data_t struct to calculate the sequence size, leading to the out-of-bounds read. To fix this, in element_end, ensure that the stack is popped even if the element's data failed to parse. This prevents the stack desynchronization. --- src/sdp-xml.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/src/sdp-xml.c b/src/sdp-xml.c index a83dec157..e5b30e885 100644 --- a/src/sdp-xml.c +++ b/src/sdp-xml.c @@ -545,8 +545,15 @@ static void element_end(GMarkupParseContext *context, return; } - if (!ctx_data->stack_head || !ctx_data->stack_head->data) { + if (!ctx_data->stack_head) + return; + + if (!ctx_data->stack_head->data) { DBG("No data for %s", element_name); + + elem = ctx_data->stack_head; + ctx_data->stack_head = ctx_data->stack_head->next; + sdp_xml_data_free(elem); return; } -- 2.47.3