Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 04122097 authored by Brian Delwiche's avatar Brian Delwiche
Browse files

Fix heap-buffer overflow in sdp_utils.cc 

Fuzzer identifies a case where sdpu_compare_uuid_with_attr crashes with
an out of bounds comparison.  Although the bug claims this is due to a
comparison of a uuid with a smaller data field thana the discovery
attribute, my research suggests that this instead stems from a
comparison of a 128 bit UUID with a discovery attribute of some other,
invalid size.

Add checks for discovery attribute size.

Bug: 287184435
Test: atest bluetooth_test_gd_unit, net_test_stack_sdp
Tag: #security
Ignore-AOSP-First: Security
Change-Id: Id06699e51937515b2465f0b3ad72eab9e0a8e532
parent 26a9e97a

system/stack/sdp/sdp_utils.cc

+22 −2
Original line number Diff line number Diff line
@@ -1137,8 +1137,28 @@ bool sdpu_compare_uuid_arrays(const uint8_t* p_uuid1, uint32_t len1, 
 ******************************************************************************/

bool sdpu_compare_uuid_with_attr(const Uuid& uuid, tSDP_DISC_ATTR* p_attr) {

  int len = uuid.GetShortestRepresentationSize();

  if (len == 2) return uuid.As16Bit() == p_attr->attr_value.v.u16;

  if (len == 4) return uuid.As32Bit() == p_attr->attr_value.v.u32;

  if (len == 2) {

    if (SDP_DISC_ATTR_LEN(p_attr->attr_len_type) == Uuid::kNumBytes16) {

      return uuid.As16Bit() == p_attr->attr_value.v.u16;

    } else {

      LOG_ERROR("invalid length for discovery attribute");

      return (false);

    }

  }

  if (len == 4) {

    if (SDP_DISC_ATTR_LEN(p_attr->attr_len_type) == Uuid::kNumBytes32) {

      return uuid.As32Bit() == p_attr->attr_value.v.u32;

    } else {

      LOG_ERROR("invalid length for discovery attribute");

      return (false);

    }

  }



  if (SDP_DISC_ATTR_LEN(p_attr->attr_len_type) != Uuid::kNumBytes128) {

    LOG_ERROR("invalid length for discovery attribute");

    return (false);

  }



  if (memcmp(uuid.To128BitBE().data(), (void*)p_attr->attr_value.v.array,

             Uuid::kNumBytes128) == 0)

    return (true);