Skip to content

backend-native: Fix stack corruption reading RFCOMM AT+BIA= response

Igor Kovalenko requested to merge igor.v.kovalenko/pulseaudio:pr/backend-native-fix-hfp-rfcomm-stack into master

On-stack buffer size is too short for sscanf to read AT+BIA= and AT+BAC= response strings which have variable length.

Fix this by replacing sscanf with proper copy of input string.

Fixes: cca0d693 ("bluetooth: add AT+BIA support") of !631 (merged)

Problem call stack:

Program terminated with signal SIGABRT, Aborted.
[...]
#5  0x00007f63b9ccefe2 in __GI___fortify_fail (msg=msg@entry=0x7f63b9d4d0bd "stack smashing detected") at fortify_fail.c:26
#6  0x00007f63b9ccefc0 in __stack_chk_fail () at stack_chk_fail.c:24
#7  0x00007f63b17fb597 in hfp_rfcomm_handle (fd=24, t=0x560c901848f0, buf=0x7ffd6d6a1230 "AT+BIA=1,1,1,1,0,0\r") at ../src/modules/bluetooth/backend-native.c:814
Edited by Igor Kovalenko

Merge request reports