Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0ab9b925 authored by Hui Peng's avatar Hui Peng
Browse files

Fix an OOB bug in btm_delete_stored_link_key_complete 

Bug: 260568359
Test: manual
Tag: #security
Ignore-AOSP-First: security
Merged-In: Icb13312b79a59117c9524ddad4163135b364baba
Change-Id: Icb13312b79a59117c9524ddad4163135b364baba
parent 45e8d2dc

system/stack/btm/btm_devctl.cc

+6 −1
Original line number Diff line number Diff line
@@ -721,7 +721,7 @@ tBTM_STATUS BTM_DeleteStoredLinkKey(const RawAddress* bd_addr, 
 * Returns          void

 *

 ******************************************************************************/

void btm_delete_stored_link_key_complete(uint8_t* p) {

void btm_delete_stored_link_key_complete(uint8_t* p, uint16_t evt_len) {

  tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_stored_link_key_cmpl_cb;

  tBTM_DELETE_STORED_LINK_KEY_COMPLETE result;
@@ -732,6 +732,11 @@ void btm_delete_stored_link_key_complete(uint8_t* p) { 
    /* Set the call back event to indicate command complete */

    result.event = BTM_CB_EVT_DELETE_STORED_LINK_KEYS;



    if (evt_len < 3) {

      LOG(ERROR) << __func__ << "Malformatted event packet, too short";

      return;

    }



    /* Extract the result fields from the HCI event */

    STREAM_TO_UINT8(result.status, p);

    STREAM_TO_UINT16(result.num_keys, p);

system/stack/btu/btu_hcif.cc

+1 −1
Original line number Diff line number Diff line
@@ -1188,7 +1188,7 @@ static void btu_hcif_hdl_command_complete(uint16_t opcode, uint8_t* p, 
      break;



    case HCI_DELETE_STORED_LINK_KEY:

      btm_delete_stored_link_key_complete(p);

      btm_delete_stored_link_key_complete(p, evt_len);

      break;



    case HCI_READ_LOCAL_NAME:

system/stack/include/dev_hci_link_interface.h

+1 −1
Original line number Diff line number Diff line
@@ -23,7 +23,7 @@ 


#include "types/raw_address.h"



extern void btm_delete_stored_link_key_complete(uint8_t* p);

extern void btm_delete_stored_link_key_complete(uint8_t* p, uint16_t evt_len);

extern void btm_vendor_specific_evt(const uint8_t* p, uint8_t evt_len);

extern void btm_vsc_complete(uint8_t* p, uint16_t cc_opcode, uint16_t evt_len,

                             tBTM_VSC_CMPL_CB* p_vsc_cplt_cback);

system/test/mock/mock_stack_btm_devctl.cc

+2 −1
Original line number Diff line number Diff line
@@ -105,7 +105,8 @@ void BTM_WriteVoiceSettings(uint16_t settings) { 
}

void BTM_db_reset(void) { mock_function_count_map[__func__]++; }

void BTM_reset_complete() { mock_function_count_map[__func__]++; }

void btm_delete_stored_link_key_complete(uint8_t* p) {

void btm_delete_stored_link_key_complete(uint8_t* p,

                                         UNUSED_ATTR uint16_t evt_len) {

  mock_function_count_map[__func__]++;

}

void btm_dev_free() { mock_function_count_map[__func__]++; }