[PATCH BlueZ 2/2] tools: Fix btmon-logger heap-buffer-overflow triggered by HCI devcoredump

[Zijun Hu]

Kernel HCI devcoredump can accumulate a large amount of dump data from MANY
packets, then send it as a SINGLE DIAG packet to the monitor channel, so
cause payload length @len in the header exceed BTSNOOP_MAX_PACKET_SIZE, but
btmon-logger uses @len to access the payload in @buf without validating that
@len fits within @buf, causing a heap-buffer-overflow.

Kernel:
include/net/bluetooth/hci_mon.h
struct hci_mon_hdr {
	__le16  opcode;
	__le16  index;
	__le16  len;
} __packed;

BlueZ:
src/shared/btsnoop.h
#define BTSNOOP_MAX_PACKET_SIZE            (1486 + 4)
tools/btmon-logger.c
uint8_t buf[BTSNOOP_MAX_PACKET_SIZE];

Fix by clamping the payload length to the amount of data received before
accessing @buf.
---
 tools/btmon-logger.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tools/btmon-logger.c b/tools/btmon-logger.c
index 261d998a6664..b9a81965a464 100644
--- a/tools/btmon-logger.c
+++ b/tools/btmon-logger.c
@@ -94,16 +94,19 @@ static void data_callback(int fd, uint32_t events, void *user_data)
 				tv = &ctv;
 			}
 		}
 
 		opcode = le16_to_cpu(hdr.opcode);
 		index  = le16_to_cpu(hdr.index);
 		pktlen = le16_to_cpu(hdr.len);
 
+		if (pktlen > (len - sizeof(hdr)))
+			pktlen = (len - sizeof(hdr));
+
 		btsnoop_write_hci(btsnoop_file, tv, index, opcode, 0, buf,
 									pktlen);
 	}
 }
 
 static bool open_monitor_channel(void)
 {
 	struct sockaddr_hci addr;

-- 
2.34.1