Re: [PATCH] Bluetooth: hci_codec: validate vendor codec count length

[Laxman Acharya Padhya]

Hi Luiz,

Thanks for looking at this.  Sorry that my earlier wording was unclear.
I agree that the uses of p inside sizeof() and __must_be_array() are
unevaluated, and that sizeof(vnd_codecs->num) is a compile-time value of
one.

The runtime access comes from the third macro argument, count.  Here that
argument is the expression vnd_codecs->num.  Since it is not a constant
expression, __builtin_choose_expr() selects the size_mul() branch, which
effectively evaluates:

	size_mul(vnd_codecs->num, sizeof(*vnd_codecs->codec))

Evaluating the first argument reads vnd_codecs->num before the result is
compared with skb->len.  Therefore, if no byte remains after the standard
codec array, the read is already out of bounds.  The issue is this count
load, rather than any evaluation of the sizeof() operands.

I also verified this with a minimal reproducer using the same macro
expansion: the compiler emits a byte load from vnd_codecs, and ASan
reports a one-byte out-of-bounds read when the pointer is at the end of
the buffer.

Changing the trailing sizeof(vnd_codecs->num) to sizeof(*vnd_codecs)
would give the same size, but it would not prevent the earlier count
load.  The added check ensures that the count byte is present before
flex_array_size() uses it.

Thanks,
Laxman