Skip to content

[Coverity CID: 487679] Overflowed integer argument in drivers/bluetooth/hci/userchan.c #84731

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
zephyrbot opened this issue Jan 28, 2025 · 0 comments · Fixed by #89029
Closed

[Coverity CID: 487679] Overflowed integer argument in drivers/bluetooth/hci/userchan.c #84731

zephyrbot opened this issue Jan 28, 2025 · 0 comments · Fixed by #89029
Assignees
@jhedberg @alwa-nordic
Labels
area: Bluetooth HCI Bluetooth HCI Driver area: Bluetooth bug The issue is a bug, or the PR is fixing a bug Coverity A Coverity detected issue or its fix priority: high High impact/importance bug

Comments

@zephyrbot
Copy link
Collaborator

Static code scan issues found in file:

https://github.com/zephyrproject-rtos/zephyr/tree/f0d0264c057255c60e91e422406f47a7b87d8a8a/drivers/bluetooth/hci/userchan.c

Category: Insecure data handling
Function: rx_thread
Component: Drivers
CID: 487679

Details:

zephyr/drivers/bluetooth/hci/userchan.c

Line 216 in f0d0264

len = read(uc->fd, frame + frame_size, sizeof(frame) - frame_size);

Please fix or provide comments in coverity using the link:

https://scan9.scan.coverity.com/#/project-view/29271/12996?selectedIssue=487679

For more information about the violation, check the Coverity Reference. (CWE-190)

Note: This issue was created automatically. Priority was set based on classification
of the file affected and the impact field in coverity. Assignees were set using the MAINTAINERS file.
@zephyrbot zephyrbot added area: Bluetooth area: Bluetooth HCI Bluetooth HCI Driver bug The issue is a bug, or the PR is fixing a bug Coverity A Coverity detected issue or its fix priority: high High impact/importance bug labels Jan 28, 2025
ubieda added a commit to croxel/zephyr that referenced this issue Apr 24, 2025
@ubieda
bluetooth: userchan: Guard reads from beyond frame size
495bcdc 
Even though through code-inspection there isn't a clear path where the
guard wouldn't act upon the length reaching the limit, this check is
moved up to unconditially validate it on every read.

Fixes zephyrproject-rtos#84731.

Signed-off-by: Luis Ubieda <[email protected]>
@ubieda ubieda mentioned this issue Apr 24, 2025
Merged
ubieda added a commit to croxel/zephyr that referenced this issue Apr 24, 2025
@ubieda
bluetooth: userchan: Guard reads from beyond frame size
71141c2 
Even though through code-inspection there isn't a clear path where the
guard wouldn't act upon the length reaching the limit, this check is
moved up to unconditially validate it on every read.

Fixes zephyrproject-rtos#84731.

Signed-off-by: Luis Ubieda <[email protected]>
ubieda added a commit to croxel/zephyr that referenced this issue Apr 24, 2025
@ubieda
bluetooth: userchan: Guard reads from beyond frame size
f002629 
Even though through code-inspection there isn't a clear path where the
guard wouldn't act upon the length reaching the limit, this check is
moved up to unconditially validate it on every read.

Fixes zephyrproject-rtos#84731.

Signed-off-by: Luis Ubieda <[email protected]>
dleach02 pushed a commit that referenced this issue Apr 28, 2025
@ubieda @dleach02
bluetooth: userchan: Guard reads from beyond frame size
b6e2486 
Even though through code-inspection there isn't a clear path where the
guard wouldn't act upon the length reaching the limit, this check is
moved up to unconditially validate it on every read.

Fixes #84731.

Signed-off-by: Luis Ubieda <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@jhedberg jhedberg

@alwa-nordic alwa-nordic

Labels
area: Bluetooth HCI Bluetooth HCI Driver area: Bluetooth bug The issue is a bug, or the PR is fixing a bug Coverity A Coverity detected issue or its fix priority: high High impact/importance bug
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

bluetooth: hci: userchan: Guard reads from going over frame-sz croxel/zephyr
3 participants
@jhedberg @zephyrbot @alwa-nordic