korg/bluez
0
0
Fork 0
mirror of https://git.kernel.org/pub/scm/bluetooth/bluez.git synced 2024-11-15 00:04:29 +08:00
Code Issues Packages Projects Releases Wiki Activity

textfile: Fix possible bad memory access in find_key

Browse Source 
If the searched key is a prefix of the first key in the textfile,
the code will assume it's not the first line which is wrong.

The issue can be reproduced by a fuzzer. More context can be found in
https://issues.oss-fuzz.com/issues/42515619

To reproduce the issue, please kindly follow the instructions in
https://google.github.io/oss-fuzz/advanced-topics/reproducing/

Stack trace:
    #0 0x55e1c450e7ce in find_key /src/bluez/src/textfile.c:133:9
    #1 0x55e1c450e7ce in write_key /src/bluez/src/textfile.c:244:8
    #2 0x55e1c450dc33 in LLVMFuzzerTestOneInput /src/fuzz_textfile.c:61:3
    (...trace in fuzzer)
This commit is contained in:
Yun-Hao Chung 2024-11-01 15:19:39 +08:00 committed by Luiz Augusto von Dentz
parent 9e0bc3e63c
commit 5573661fc2
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/textfile.c
View File

@ -127,10 +127,10 @@ static inline char *find_key(char *map, size_t size, const char *key, size_t len
while (ptrlen > len + 1) {
int cmp = (icase) ? strncasecmp(ptr, key, len) : strncmp(ptr, key, len);
if (cmp == 0) {
if (ptr == map && *(ptr + len) == ' ')
return ptr;
if ((*(ptr - 1) == '\r' || *(ptr - 1) == '\n') &&
if (ptr == map) {
if (*(ptr + len) == ' ')
return ptr;
} else if ((*(ptr - 1) == '\r' || *(ptr - 1) == '\n') &&
*(ptr + len) == ' ')
return ptr;
}