Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Unverified Commit 6c23770f authored by Kevin F. Haggerty's avatar Kevin F. Haggerty
Browse files

Merge tag 'android-security-9.0.0_r65' of... 

Merge tag 'android-security-9.0.0_r65' of https://android.googlesource.com/platform/packages/apps/Bluetooth into staging/lineage-16.0_merge_android-security-9.0.0_r65

Android security 9.0.0 release 65

* tag 'android-security-9.0.0_r65' of https://android.googlesource.com/platform/packages/apps/Bluetooth:
  Check permission before sending batch scan result
  Check if advertiserId value matches valid advertiser

Change-Id: Ib67b01db9de18c75b2eb4005e1c8a1a9e04fca2d
parents f245178d 74d14ce9

src/com/android/bluetooth/gatt/AdvertiseManager.java

+41 −1
Original line number Diff line number Diff line
@@ -217,7 +217,7 @@ class AdvertiseManager { 


        Map.Entry<IBinder, AdvertiserInfo> entry = findAdvertiser(advertiserId);

        if (entry == null) {

            Log.i(TAG, "onOwnAddressRead() - bad advertiserId " + advertiserId);

            Log.w(TAG, "onOwnAddressRead() - bad advertiserId " + advertiserId);

            return;

        }
@@ -226,6 +226,11 @@ class AdvertiseManager { 
    }



    void getOwnAddress(int advertiserId) {

        Map.Entry<IBinder, AdvertiserInfo> entry = findAdvertiser(advertiserId);

        if (entry == null) {

            Log.w(TAG, "getOwnAddress() - bad advertiserId " + advertiserId);

            return;

        }

        getOwnAddressNative(advertiserId);

    }
@@ -260,37 +265,72 @@ class AdvertiseManager { 
    }



    void enableAdvertisingSet(int advertiserId, boolean enable, int duration, int maxExtAdvEvents) {

        Map.Entry<IBinder, AdvertiserInfo> entry = findAdvertiser(advertiserId);

        if (entry == null) {

            Log.w(TAG, "enableAdvertisingSet() - bad advertiserId " + advertiserId);

            return;

        }

        enableAdvertisingSetNative(advertiserId, enable, duration, maxExtAdvEvents);

    }



    void setAdvertisingData(int advertiserId, AdvertiseData data) {

        Map.Entry<IBinder, AdvertiserInfo> entry = findAdvertiser(advertiserId);

        if (entry == null) {

            Log.w(TAG, "setAdvertisingData() - bad advertiserId " + advertiserId);

            return;

        }

        String deviceName = AdapterService.getAdapterService().getName();

        setAdvertisingDataNative(advertiserId,

                AdvertiseHelper.advertiseDataToBytes(data, deviceName));

    }



    void setScanResponseData(int advertiserId, AdvertiseData data) {

        Map.Entry<IBinder, AdvertiserInfo> entry = findAdvertiser(advertiserId);

        if (entry == null) {

            Log.w(TAG, "setScanResponseData() - bad advertiserId " + advertiserId);

            return;

        }

        String deviceName = AdapterService.getAdapterService().getName();

        setScanResponseDataNative(advertiserId,

                AdvertiseHelper.advertiseDataToBytes(data, deviceName));

    }



    void setAdvertisingParameters(int advertiserId, AdvertisingSetParameters parameters) {

        Map.Entry<IBinder, AdvertiserInfo> entry = findAdvertiser(advertiserId);

        if (entry == null) {

            Log.w(TAG, "setAdvertisingParameters() - bad advertiserId " + advertiserId);

            return;

        }

        setAdvertisingParametersNative(advertiserId, parameters);

    }



    void setPeriodicAdvertisingParameters(int advertiserId,

            PeriodicAdvertisingParameters parameters) {

        Map.Entry<IBinder, AdvertiserInfo> entry = findAdvertiser(advertiserId);

        if (entry == null) {

            Log.w(TAG, "setPeriodicAdvertisingParameters() - bad advertiserId " + advertiserId);

            return;

        }

        setPeriodicAdvertisingParametersNative(advertiserId, parameters);

    }



    void setPeriodicAdvertisingData(int advertiserId, AdvertiseData data) {

        Map.Entry<IBinder, AdvertiserInfo> entry = findAdvertiser(advertiserId);

        if (entry == null) {

            Log.w(TAG, "setPeriodicAdvertisingData() - bad advertiserId " + advertiserId);

            return;

        }

        String deviceName = AdapterService.getAdapterService().getName();

        setPeriodicAdvertisingDataNative(advertiserId,

                AdvertiseHelper.advertiseDataToBytes(data, deviceName));

    }



    void setPeriodicAdvertisingEnable(int advertiserId, boolean enable) {

        Map.Entry<IBinder, AdvertiserInfo> entry = findAdvertiser(advertiserId);

        if (entry == null) {

            Log.w(TAG, "setPeriodicAdvertisingEnable() - bad advertiserId " + advertiserId);

            return;

        }

        setPeriodicAdvertisingEnableNative(advertiserId, enable);

    }

src/com/android/bluetooth/gatt/GattService.java

+28 −0
Original line number Diff line number Diff line
@@ -1531,6 +1531,15 @@ public class GattService extends ProfileService { 
        mScanManager.callbackDone(clientIf, status);

    }



    ScanClient findBatchScanClientById(int scannerId) {

        for (ScanClient client : mScanManager.getBatchScanQueue()) {

            if (client.scannerId == scannerId) {

                return client;

            }

        }

        return null;

    }



    void onBatchScanReports(int status, int scannerId, int reportType, int numRecords,

            byte[] recordData) throws RemoteException {

        if (DBG) {
@@ -1545,6 +1554,18 @@ public class GattService extends ProfileService { 
            if (app == null) {

                return;

            }



            ScanClient client = findBatchScanClientById(scannerId);

            if (client == null) {

                return;

            }



            // Do no report if location mode is OFF or the client has no location permission

            // PEERS_MAC_ADDRESS permission holders always get results

            if (!hasScanResultPermission(client)) {

                return;

            }



            if (app.callback != null) {

                app.callback.onBatchScanResults(new ArrayList<ScanResult>(results));

            } else {
@@ -1586,6 +1607,13 @@ public class GattService extends ProfileService { 
        if (app == null) {

            return;

        }



        // Do no report if location mode is OFF or the client has no location permission

        // PEERS_MAC_ADDRESS permission holders always get results

        if (!hasScanResultPermission(client)) {

            return;

        }



        if (client.filters == null || client.filters.isEmpty()) {

            sendBatchScanResults(app, client, new ArrayList<ScanResult>(allResults));

            // TODO: Question to reviewer: Shouldn't there be a return here?