From e1c125dcead52a128fd86c256f8d007373cdacff Mon Sep 17 00:00:00 2001 From: Andrei Emeltchenko Date: Tue, 12 Aug 2014 15:46:33 +0300 Subject: [PATCH] shared/btsnoop: Fix segmentation fault with malformed packet Do not allow to read more then buffer size. This fixes segmentation fault reading capture from target (apparently end of the trace was broken). --- src/shared/btsnoop.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/shared/btsnoop.c b/src/shared/btsnoop.c index 17a872ceb..3592c2ed5 100644 --- a/src/shared/btsnoop.c +++ b/src/shared/btsnoop.c @@ -415,6 +415,11 @@ bool btsnoop_read_hci(struct btsnoop *btsnoop, struct timeval *tv, } toread = be32toh(pkt.size); + if (toread > BTSNOOP_MAX_PACKET_SIZE) { + btsnoop->aborted = true; + return false; + } + flags = be32toh(pkt.flags); ts = be64toh(pkt.ts) - 0x00E03AB44A676000ll; -- 2.47.3