From f05e448cf81b6ff0a8c7fc1e3accdb4f436a46e0 Mon Sep 17 00:00:00 2001 From: Bastien Nocera Date: Thu, 16 May 2024 11:03:15 +0200 Subject: [PATCH] isotest: Fix string size expectations Verify that the peer is a valid bdaddr (and so has the correct length) before using it. Error: STRING_SIZE (CWE-120): [#def54] [important] tools/isotest.c:1198:26: string_size_argv: "argv" contains strings with unknown size. tools/isotest.c:1459:4: string_size: Passing string "argv[optind + i]" of unknown size to "send_mode", which expects a string of a particular size. Error: STRING_SIZE (CWE-120): [#def55] [important] tools/isotest.c:1198:26: string_size_argv: "argv" contains strings with unknown size. tools/isotest.c:1476:4: var_assign_var: Assigning: "peer" = "argv[optind + i]". Both are now tainted. tools/isotest.c:1484:5: string_size: Passing string "peer" of unknown size to "bcast_do_connect_mbis", which expects a string of a particular size. Error: STRING_SIZE (CWE-120): [#def56] [important] tools/isotest.c:1198:26: string_size_argv: "argv" contains strings with unknown size. tools/isotest.c:1476:4: var_assign_var: Assigning: "peer" = "argv[optind + i]". Both are now tainted. tools/isotest.c:1514:5: string_size: Passing string "argv[optind + i]" of unknown size to "do_connect", which expects a string of a particular size. --- tools/isotest.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/tools/isotest.c b/tools/isotest.c index fc1c26b23..68154b19c 100644 --- a/tools/isotest.c +++ b/tools/isotest.c @@ -1456,7 +1456,13 @@ int main(int argc, char *argv[]) switch (mode) { case SEND: - send_mode(filename, argv[optind + i], i, repeat); + peer = argv[optind + i]; + if (bachk(peer) < 0) { + fprintf(stderr, "Invalid peer address '%s'\n", + peer); + exit(1); + } + send_mode(filename, peer, i, repeat); if (filename && strchr(filename, ',')) { char *tmp = filename; filename = strdup(strchr(filename, ',') + 1); @@ -1474,6 +1480,11 @@ int main(int argc, char *argv[]) case CONNECT: peer = argv[optind + i]; + if (bachk(peer) < 0) { + fprintf(stderr, "Invalid peer address '%s'\n", + peer); + exit(1); + } mgmt_set_experimental(); @@ -1511,7 +1522,7 @@ int main(int argc, char *argv[]) free(sk_arr); } else { - sk = do_connect(argv[optind + i]); + sk = do_connect(peer); if (sk < 0) exit(1); -- 2.47.3