Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 14eaa92e authored by Hui Peng's avatar Hui Peng
Browse files

Fix an OOB bug in btm_read_local_oob_complete 

Bug: 260568354
Test: manual
Tag: #security
Ignore-AOSP-First: security
Merged-In: I739a42519df656b28d6043f179d02316bf5a71f2
Change-Id: I739a42519df656b28d6043f179d02316bf5a71f2
parent 45e8d2dc

system/stack/btm/btm_sec.cc

+17 −2
Original line number Diff line number Diff line
@@ -2985,13 +2985,23 @@ void btm_rem_oob_req(const uint8_t* p) { 
 * Returns          void

 *

 ******************************************************************************/

void btm_read_local_oob_complete(uint8_t* p) {

void btm_read_local_oob_complete(uint8_t* p, uint16_t evt_len) {

  tBTM_SP_LOC_OOB evt_data;

  uint8_t status = *p++;

  uint8_t status;

  if (evt_len < 1) {

    goto err_out;

  }



  STREAM_TO_UINT8(status, p);



  BTM_TRACE_EVENT("btm_read_local_oob_complete:%d", status);

  if (status == HCI_SUCCESS) {

    evt_data.status = BTM_SUCCESS;



    if (evt_len < 1 + 32) {

      goto err_out;

    }



    STREAM_TO_ARRAY16(evt_data.c.data(), p);

    STREAM_TO_ARRAY16(evt_data.r.data(), p);

  } else
@@ -3002,6 +3012,11 @@ void btm_read_local_oob_complete(uint8_t* p) { 
    btm_sp_evt_data.loc_oob = evt_data;

    (*btm_cb.api.p_sp_callback)(BTM_SP_LOC_OOB_EVT, &btm_sp_evt_data);

  }



  return;



err_out:

  BTM_TRACE_ERROR("%s malformatted event packet, too short", __func__);

}



/*******************************************************************************

system/stack/btm/btm_sec.h

+1 −1
Original line number Diff line number Diff line
@@ -582,7 +582,7 @@ void btm_rem_oob_req(const uint8_t* p); 
 * Returns          void

 *

 ******************************************************************************/

void btm_read_local_oob_complete(uint8_t* p);

void btm_read_local_oob_complete(uint8_t* p, uint16_t evt_len);



/*******************************************************************************

 *

system/stack/btu/btu_hcif.cc

+1 −1
Original line number Diff line number Diff line
@@ -1220,7 +1220,7 @@ static void btu_hcif_hdl_command_complete(uint16_t opcode, uint8_t* p, 
      break;



    case HCI_READ_LOCAL_OOB_DATA:

      btm_read_local_oob_complete(p);

      btm_read_local_oob_complete(p, evt_len);

      break;



    case HCI_READ_INQ_TX_POWER_LEVEL:

system/stack/include/sec_hci_link_interface.h

+1 −1
Original line number Diff line number Diff line
@@ -31,7 +31,7 @@ void btm_io_capabilities_req(const RawAddress& p); 
void btm_io_capabilities_rsp(const uint8_t* p);

void btm_proc_sp_req_evt(tBTM_SP_EVT event, const uint8_t* p);

void btm_read_inq_tx_power_complete(uint8_t* p);

void btm_read_local_oob_complete(uint8_t* p);

void btm_read_local_oob_complete(uint8_t* p, uint16_t evt_len);

void btm_rem_oob_req(const uint8_t* p);

void btm_sec_auth_complete(uint16_t handle, tHCI_STATUS status);

void btm_sec_disconnected(uint16_t handle, tHCI_STATUS reason, std::string);

system/test/mock/mock_stack_btm_sec.cc

+1 −1
Original line number Diff line number Diff line
@@ -251,7 +251,7 @@ void btm_io_capabilities_rsp(const uint8_t* p) { 
void btm_proc_sp_req_evt(tBTM_SP_EVT event, const uint8_t* p) {

  mock_function_count_map[__func__]++;

}

void btm_read_local_oob_complete(uint8_t* p) {

void btm_read_local_oob_complete(uint8_t* p, uint16_t evt_len) {

  mock_function_count_map[__func__]++;

}

void btm_rem_oob_req(const uint8_t* p) { mock_function_count_map[__func__]++; }