From 913f459bbc178aba98b55d4fd9ca783cee20e051 Mon Sep 17 00:00:00 2001 From: Andrei Emeltchenko Date: Tue, 12 Aug 2014 15:46:34 +0300 Subject: [PATCH] btmon: Fix segmentation fault with malformed packet Do not allow to read more then buffer size. This fixes segmentation fault reading capture from target (apparently end of the trace was broken). --- monitor/btsnoop.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/monitor/btsnoop.c b/monitor/btsnoop.c index fafeff8b5..83aaee5a8 100644 --- a/monitor/btsnoop.c +++ b/monitor/btsnoop.c @@ -304,6 +304,13 @@ int btsnoop_read_hci(struct timeval *tv, uint16_t *index, uint16_t *opcode, } toread = be32toh(pkt.size); + if (toread > BTSNOOP_MAX_PACKET_SIZE) { + perror("Packet len suspicially big: %u", toread); + close(btsnoop_fd); + btsnoop_fd = -1; + return -1; + } + flags = be32toh(pkt.flags); ts = be64toh(pkt.ts) - 0x00E03AB44A676000ll; -- 2.47.3