On 2018-11-02 10:05, P J P wrote: > +-- On Sat, 27 Oct 2018, P J P wrote --+ > |+-- On Sun, 21 Oct 2018, P J P wrote --+ > || The length parameter values are not negative, thus use an unsigned > || type 'size_t' for them. Many routines pass 'len' values to memcpy(3) > || calls. If it was negative, it could lead to memory corruption issues. > || Add check to avoid it. > || > || Reported-by: Arash TC <tohidi.ar...@gmail.com> > || Signed-off-by: Prasad J Pandit <p...@fedoraproject.org> > || --- > || bt-host.c | 8 +++--- > || bt-vhci.c | 7 +++--- > || hw/bt/core.c | 2 +- > || hw/bt/hci-csr.c | 20 +++++++-------- > || hw/bt/hci.c | 38 ++++++++++++++-------------- > || hw/bt/hid.c | 10 ++++---- > || hw/bt/l2cap.c | 56 ++++++++++++++++++++++-------------------- > || hw/bt/sdp.c | 6 ++--- > || hw/usb/dev-bluetooth.c | 12 ++++----- > || include/hw/bt.h | 8 +++--- > || include/sysemu/bt.h | 10 ++++---- > || 11 files changed, 90 insertions(+), 87 deletions(-) > || > || Update v1: add assert check in vhci_host_send. Also check other places > wherein > || length is used with fixed size buffers. > || -> https://lists.gnu.org/archive/html/qemu-devel/2018-10/msg03831.html > | > | Ping...! > > Ping...!
The bluetooth subsystem is completely unmaintained, so if Paolo does not want to pick it up through his "misc" tree, maybe Peter could apply this patch directly? Or maybe it could go through the trivial tree since it does not look very complicated? FWIW, the patch looks OK to me at a first glance, so: Acked-by: Thomas Huth <th...@redhat.com> PS: I still think we should deprecate the bt subsystem, since nobody really touched it within years...
