Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1cd9393f authored by Brian Delwiche's avatar Brian Delwiche Committed by Automerger Merge Worker
Browse files

Resolve incomplete fix for SMP authentication bypass am: 7beac6cb am: 13d12470 am: b0663042 

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/29861873



Change-Id: I3994179d23233098d4c787691f7c76c06eacb41d
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 2d712c96 b0663042

system/stack/smp/smp_act.cc

+11 −0
Original line number Diff line number Diff line
@@ -721,6 +721,17 @@ void smp_proc_rand(tSMP_CB* p_cb, tSMP_INT_DATA* p_data) { 
    return;

  }



  if (!((p_cb->loc_auth_req & SMP_SC_SUPPORT_BIT) &&

        (p_cb->peer_auth_req & SMP_SC_SUPPORT_BIT)) &&

      !(p_cb->flags & SMP_PAIR_FLAGS_CMD_CONFIRM_SENT)) {

    // in legacy pairing, the peer should send its rand after

    // we send our confirm

    tSMP_INT_DATA smp_int_data{};

    smp_int_data.status = SMP_INVALID_PARAMETERS;

    smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &smp_int_data);

    return;

  }



  /* save the SRand for comparison */

  STREAM_TO_ARRAY(p_cb->rrand.data(), p, OCTET16_LEN);

}