⬢ DragonFlyBSD Kernel Audit
DF-0559 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
diff --git a/sys/netbt/hci_event.c b/sys/netbt/hci_event.c
--- a/sys/netbt/hci_event.c
+++ b/sys/netbt/hci_event.c
@@ -451,8 +451,14 @@
 	DPRINTFN(1, "(%s) %d response%s\n", device_get_nameunit(unit->hci_dev),
 	    ep.num_responses, (ep.num_responses == 1 ? "" : "s"));
 
+	if (m->m_pkthdr.len < ep.num_responses * sizeof(ir)) {
+		kprintf("%s: malformed Inquiry_Result: claims %d responses "
+		    "but only %d bytes remain\n",
+		    device_get_nameunit(unit->hci_dev), ep.num_responses,
+		    m->m_pkthdr.len);
+		return;
+	}
 	while(ep.num_responses--) {
-		KKASSERT(m->m_pkthdr.len >= sizeof(ir));
 		m_copydata(m, 0, sizeof(ir), &ir);
 		m_adj(m, sizeof(ir));
 
@@ -488,8 +494,14 @@
 	DPRINTFN(1, "%d response%s\n", ep.num_responses,
 				(ep.num_responses == 1 ? "" : "s"));
 
+	if (m->m_pkthdr.len < ep.num_responses * sizeof(rr)) {
+		kprintf("%s: malformed Inquiry_Result_with_RSSI: claims %d "
+		    "responses but only %d bytes remain\n",
+		    device_get_nameunit(unit->hci_dev), ep.num_responses,
+		    m->m_pkthdr.len);
+		return;
+	}
 	while(ep.num_responses--) {
-		KKASSERT(m->m_pkthdr.len >= sizeof(rr));
 		m_copydata(m, 0, sizeof(rr), &rr);
 		m_adj(m, sizeof(rr));