From: Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx> The return value of a call to snprintf is the number of characters that would have been written to the buffer assuming there was sufficient space. In the event that the operation reaches the end of the buffer and more than one character is discarded, the return value will be greater than the buffer size. Fixes: https://github.com/bluez/bluez/issues/1216 Fixes: https://github.com/bluez/bluez/issues/1217 Fixes: https://github.com/bluez/bluez/issues/1218 Fixes: https://github.com/bluez/bluez/issues/1219 --- client/mgmt.c | 48 ++++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 40 insertions(+), 8 deletions(-) diff --git a/client/mgmt.c b/client/mgmt.c index 86b5879db8b0..faa97a159e3c 100644 --- a/client/mgmt.c +++ b/client/mgmt.c @@ -316,9 +316,17 @@ static const char *options2str(uint32_t options) str[0] = '\0'; for (i = 0; i < NELEM(options_str); i++) { - if ((options & (1 << i)) != 0) - off += snprintf(str + off, sizeof(str) - off, "%s ", + if ((options & (1 << i)) != 0) { + int n = snprintf(str + off, sizeof(str) - off, "%s ", options_str[i]); + + if (n < 0 || n >= (int)(sizeof(str) - off)) { + str[off] = '\0'; + break; + } + + off += n; + } } return str; @@ -372,9 +380,17 @@ static const char *settings2str(uint32_t settings) str[0] = '\0'; for (i = 0; i < NELEM(settings_str); i++) { - if ((settings & (1 << i)) != 0) - off += snprintf(str + off, sizeof(str) - off, "%s ", + if ((settings & (1 << i)) != 0) { + int n = snprintf(str + off, sizeof(str) - off, "%s ", settings_str[i]); + + if (n < 0 || n >= (int)(sizeof(str) - off)) { + str[off] = '\0'; + break; + } + + off += n; + } } return str; @@ -4490,9 +4506,17 @@ static const char *adv_flags2str(uint32_t flags) str[0] = '\0'; for (i = 0; i < NELEM(adv_flags_str); i++) { - if ((flags & (1 << i)) != 0) - off += snprintf(str + off, sizeof(str) - off, "%s ", + if ((flags & (1 << i)) != 0) { + int n = snprintf(str + off, sizeof(str) - off, "%s ", adv_flags_str[i]); + + if (n < 0 || n >= (int)(sizeof(str) - off)) { + str[off] = '\0'; + break; + } + + off += n; + } } return str; @@ -5429,9 +5453,17 @@ static const char *phys2str(uint32_t phys) str[0] = '\0'; for (i = 0; i < NELEM(phys_str); i++) { - if ((phys & (1 << i)) != 0) - off += snprintf(str + off, sizeof(str) - off, "%s ", + if ((phys & (1 << i)) != 0) { + int n = snprintf(str + off, sizeof(str) - off, "%s ", phys_str[i]); + + if (n < 0 || n >= (int)(sizeof(str) - off)) { + str[off] = '\0'; + break; + } + + off += n; + } } return str; -- 2.49.0
