Security vulnerabilities and automated fixes for bluetooth issues
2 posts found
A critical heap buffer overflow vulnerability was discovered in the BLE MIDI packet assembly code of `blemidi.c`, where attacker-controlled packet length values could trigger writes beyond allocated heap memory. The fix adds an integer overflow guard before the `malloc` call, ensuring that maliciously crafted BLE MIDI packets can no longer corrupt heap memory. This vulnerability is particularly dangerous because it is remotely exploitable by any nearby Bluetooth device — no physical access requi
A critical heap buffer overflow vulnerability was discovered and patched in `ble_spam.c`, where two consecutive `memcpy` calls copied attacker-controlled data into fixed-size heap buffers without validating the copy length first. An attacker within Bluetooth range could exploit this flaw to crash the target device, corrupt memory, or potentially execute arbitrary code — all without any authentication. The fix adds a proper bounds check before the copy operations, ensuring the length derived from