From 7a80d2096f1b7125085e21448112aa02f49f5e9a Mon Sep 17 00:00:00 2001
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: Thu, 29 Apr 2021 17:10:50 -0700
Subject: [PATCH] avdtp: Fix accepting invalid/malformed capabilities

Check if capabilities are valid before attempting to copy them.

Joey Lee:
Add the following changes from other patches for using btd_malloc() in
avdtp.c :
- Add src/shared/util.h and src/shared/util.c to src_bluetoothd_SOURCES.
  Originally the change is from "4963a4c6ae core: Introduce initial hooks
  to new mgmt code for adapter.c" patch since bluez 5.1. 
- Add #include "src/shared/util.h". Originally it be added by
  "aabaa70200f2 audio/avdtp: Use bitfield id generation" patch since
  bluez 5.29.
---
 profiles/audio/avdtp.c | 56 +++++++++++++++++++++++++++---------------
 1 file changed, 36 insertions(+), 20 deletions(-)

Index: bluez-4.99/audio/avdtp.c
===================================================================
--- bluez-4.99.orig/audio/avdtp.c
+++ bluez-4.99/audio/avdtp.c
@@ -43,6 +43,7 @@
 #include <dbus/dbus.h>
 
 #include "log.h"
+#include "src/shared/util.h"
 
 #include "../src/adapter.h"
 #include "../src/manager.h"
@@ -1307,43 +1308,53 @@ struct avdtp_remote_sep *avdtp_find_remo
 	return NULL;
 }
 
-static GSList *caps_to_list(uint8_t *data, int size,
+static GSList *caps_to_list(uint8_t *data, size_t size,
 				struct avdtp_service_capability **codec,
 				gboolean *delay_reporting)
 {
+	struct avdtp_service_capability *cap;
 	GSList *caps;
-	int processed;
 
 	if (delay_reporting)
 		*delay_reporting = FALSE;
 
-	for (processed = 0, caps = NULL; processed + 2 <= size;) {
-		struct avdtp_service_capability *cap;
-		uint8_t length, category;
+	if (size < sizeof(*cap))
+		return NULL;
 
-		category = data[0];
-		length = data[1];
+	for (caps = NULL; size >= sizeof(*cap);) {
+		struct avdtp_service_capability *cpy;
 
-		if (processed + 2 + length > size) {
+		cap = (struct avdtp_service_capability *)data;
+
+		if (sizeof(*cap) + cap->length >= size) {
 			error("Invalid capability data in getcap resp");
 			break;
 		}
 
-		cap = g_malloc(sizeof(struct avdtp_service_capability) +
-					length);
-		memcpy(cap, data, 2 + length);
-
-		processed += 2 + length;
-		data += 2 + length;
-
-		caps = g_slist_append(caps, cap);
-
-		if (category == AVDTP_MEDIA_CODEC &&
-				length >=
-				sizeof(struct avdtp_media_codec_capability))
-			*codec = cap;
-		else if (category == AVDTP_DELAY_REPORTING && delay_reporting)
-			*delay_reporting = TRUE;
+		if (cap->category == AVDTP_MEDIA_CODEC &&
+					cap->length < sizeof(**codec)) {
+			error("Invalid codec data in getcap resp");
+			break;
+		}
+
+		cpy = btd_malloc(sizeof(*cpy) + cap->length);
+		memcpy(cpy, cap, sizeof(*cap) + cap->length);
+
+		size -= sizeof(*cap) + cap->length;
+		data += sizeof(*cap) + cap->length;
+
+		caps = g_slist_append(caps, cpy);
+
+		switch (cap->category) {
+		case AVDTP_MEDIA_CODEC:
+			if (codec)
+				*codec = cap;
+			break;
+		case AVDTP_DELAY_REPORTING:
+			if (delay_reporting)
+				*delay_reporting = TRUE;
+			break;
+		}
 	}
 
 	return caps;
@@ -1538,6 +1549,12 @@ static gboolean avdtp_setconf_cmd(struct
 					&stream->codec,
 					&stream->delay_reporting);
 
+	if (!stream->caps || !stream->codec) {
+		err = AVDTP_UNSUPPORTED_CONFIGURATION;
+		category = 0x00;
+		goto failed_stream;
+	}
+
 	/* Verify that the Media Transport capability's length = 0. Reject otherwise */
 	for (l = stream->caps; l != NULL; l = g_slist_next(l)) {
 		struct avdtp_service_capability *cap = l->data;
Index: bluez-4.99/Makefile.am
===================================================================
--- bluez-4.99.orig/Makefile.am
+++ bluez-4.99/Makefile.am
@@ -309,7 +309,8 @@ src_bluetoothd_SOURCES = $(gdbus_sources
 			src/device.h src/device.c src/attio.h \
 			src/dbus-common.c src/dbus-common.h \
 			src/event.h src/event.c \
-			src/oob.h src/oob.c src/eir.h src/eir.c
+			src/oob.h src/oob.c src/eir.h src/eir.c \
+			src/shared/util.h src/shared/util.c
 src_bluetoothd_LDADD = lib/libbluetooth-private.la @GLIB_LIBS@ @DBUS_LIBS@ \
 							@CAPNG_LIBS@ -ldl -lrt
 src_bluetoothd_LDFLAGS = -Wl,--export-dynamic \
