Verify that the peer is a valid bdaddr (and so has the correct length)
before using it.
Error: STRING_SIZE (CWE-120): [#def54] [important]
bluez-5.75/tools/isotest.c:1198:26: string_size_argv: "argv" contains strings with unknown size.
bluez-5.75/tools/isotest.c:1459:4: string_size: Passing string "argv[optind + i]" of unknown size to "send_mode", which expects a string of a particular size.
Error: STRING_SIZE (CWE-120): [#def55] [important]
bluez-5.75/tools/isotest.c:1198:26: string_size_argv: "argv" contains strings with unknown size.
bluez-5.75/tools/isotest.c:1476:4: var_assign_var: Assigning: "peer" = "argv[optind + i]". Both are now tainted.
bluez-5.75/tools/isotest.c:1484:5: string_size: Passing string "peer" of unknown size to "bcast_do_connect_mbis", which expects a string of a particular size.
Error: STRING_SIZE (CWE-120): [#def56] [important]
bluez-5.75/tools/isotest.c:1198:26: string_size_argv: "argv" contains strings with unknown size.
bluez-5.75/tools/isotest.c:1476:4: var_assign_var: Assigning: "peer" = "argv[optind + i]". Both are now tainted.
bluez-5.75/tools/isotest.c:1514:5: string_size: Passing string "argv[optind + i]" of unknown size to "do_connect", which expects a string of a particular size.
---
tools/isotest.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/tools/isotest.c b/tools/isotest.c
index fc1c26b23c3b..f98f25497b85 100644
--- a/tools/isotest.c
+++ b/tools/isotest.c
@@ -1456,7 +1456,12 @@ int main(int argc, char *argv[])
switch (mode) {
case SEND:
- send_mode(filename, argv[optind + i], i, repeat);
+ peer = argv[optind + i];
+ if (bachk(peer) < 0) {
+ fprintf(stderr, "Invalid peer address '%s'\n", peer);
+ exit(1);
+ }
+ send_mode(filename, peer, i, repeat);
if (filename && strchr(filename, ',')) {
char *tmp = filename;
filename = strdup(strchr(filename, ',') + 1);
@@ -1474,6 +1479,10 @@ int main(int argc, char *argv[])
case CONNECT:
peer = argv[optind + i];
+ if (bachk(peer) < 0) {
+ fprintf(stderr, "Invalid peer address '%s'\n", peer);
+ exit(1);
+ }
mgmt_set_experimental();
@@ -1511,7 +1520,7 @@ int main(int argc, char *argv[])
free(sk_arr);
} else {
- sk = do_connect(argv[optind + i]);
+ sk = do_connect(peer);
if (sk < 0)
exit(1);
--
2.44.0
