sdp: Properly terminate attribute with NIL length (2029f4f8) · Commits · e / os / android_packages_modules_Bluetooth

system/stack/Android.bp

+12 −5

Original line number	Diff line number	Diff line
		@@ -410,12 +410,16 @@ cc_fuzz {
		"fuzzers/sdp_fuzzer.cc",
		],
		static_libs: [
		"bluetooth_flags_c_lib",
		"libbluetooth-types",
		"libbluetooth_log",
		"libbt-platform-protos-lite",
		"libbt_shim_bridge",
		"libbt_shim_ffi",
		],
		shared_libs: [
		"server_configurable_flags",
		],
		}

		cc_fuzz {
		@@ -2139,26 +2143,24 @@ cc_test {
		],
		include_dirs: [
		"packages/modules/Bluetooth/system",
		"packages/modules/Bluetooth/system/device/include/",
		"packages/modules/Bluetooth/system/gd",
		"packages/modules/Bluetooth/system/stack/btm",
		],
		srcs: [
		":LegacyStackSdp",
		":TestCommonMockFunctions",
		":TestFakeOsi",
		":TestMockBtif",
		":TestMockOsi",
		":TestMockStackBtm",
		":TestMockStackL2cap",
		":TestMockStackMetrics",
		"test/sdp/stack_sdp_db_test.cc",
		"test/sdp/stack_sdp_parse_test.cc",
		"test/sdp/stack_sdp_test.cc",
		"test/sdp/stack_sdp_utils_test.cc",
		],
		shared_libs: [
		"libcutils",
		],
		static_libs: [
		"bluetooth_flags_c_lib",
		"libbase",
		"libbluetooth-types",
		"libbluetooth_gd",
		@@ -2168,8 +2170,13 @@ cc_test {
		"libbt_shim_bridge",
		"libbt_shim_ffi",
		"libchrome",
		"libflagtest",
		"libgmock",
		"liblog",
		],
		shared_libs: [
		"libcutils",
		"server_configurable_flags",
		],
		header_libs: ["libbluetooth_headers"],
		}

system/stack/include/sdpdefs.h

+84 −17

Original line number	Diff line number	Diff line
		@@ -25,11 +25,17 @@
		#ifndef SDP_DEFS_H
		#define SDP_DEFS_H

		#include <cstdint>
		#include <base/strings/stringprintf.h>

		#include <string>

		#include "macros.h"

		/* Define the service attribute IDs.
		*/
		#define ATTR_ID_SERVICE_RECORD_HDL 0x0000
		#define ATTR_ID_SERVICE_CLASS_ID_LIST 0x0001
		#define ATTR_ID_SERVICE_RECORD_STATE 0x0002
		#define ATTR_ID_SERVICE_ID 0x0003
		#define ATTR_ID_PROTOCOL_DESC_LIST 0x0004
		#define ATTR_ID_BROWSE_GROUP_LIST 0x0005
		@@ -99,31 +105,92 @@
		#define ATTR_ID_HID_SSR_HOST_MAX_LAT 0x020F
		#define ATTR_ID_HID_SSR_HOST_MIN_TOUT 0x0210

		inline std::string sdp_attr_id_text(const unsigned& id) {
		switch (id) {
		CASE_RETURN_TEXT(ATTR_ID_SERVICE_RECORD_HDL);
		CASE_RETURN_TEXT(ATTR_ID_SERVICE_CLASS_ID_LIST);
		CASE_RETURN_TEXT(ATTR_ID_SERVICE_RECORD_STATE);
		CASE_RETURN_TEXT(ATTR_ID_SERVICE_ID);
		CASE_RETURN_TEXT(ATTR_ID_PROTOCOL_DESC_LIST);
		CASE_RETURN_TEXT(ATTR_ID_BROWSE_GROUP_LIST);
		CASE_RETURN_TEXT(ATTR_ID_LANGUAGE_BASE_ATTR_ID_LIST);
		CASE_RETURN_TEXT(ATTR_ID_BT_PROFILE_DESC_LIST);
		CASE_RETURN_TEXT(ATTR_ID_DOCUMENTATION_URL);
		CASE_RETURN_TEXT(ATTR_ID_CLIENT_EXE_URL);
		CASE_RETURN_TEXT(ATTR_ID_ADDITION_PROTO_DESC_LISTS);
		CASE_RETURN_TEXT(ATTR_ID_SERVICE_NAME);
		CASE_RETURN_TEXT(ATTR_ID_SERVICE_DESCRIPTION);
		CASE_RETURN_TEXT(ATTR_ID_PROVIDER_NAME);
		default:
		return base::StringPrintf("SDP_ATTR_ID:[%u]", id);
		}
		}

		#define UUID_CODEC_CVSD 0x0001 /* CVSD */
		#define UUID_CODEC_MSBC 0x0002 /* mSBC */
		#define UUID_CODEC_LC3 0x0003 /* LC3 */

		/* Define all the 'Descriptor Type' values.
		*/
		#define UINT_DESC_TYPE 1
		#define TWO_COMP_INT_DESC_TYPE 2
		#define UUID_DESC_TYPE 3
		#define TEXT_STR_DESC_TYPE 4
		#define BOOLEAN_DESC_TYPE 5
		#define DATA_ELE_SEQ_DESC_TYPE 6
		#define DATA_ELE_ALT_DESC_TYPE 7
		#define URL_DESC_TYPE 8
		enum : unsigned {
		NIL_DESC_TYPE = 0,
		UINT_DESC_TYPE = 1,
		TWO_COMP_INT_DESC_TYPE = 2,
		UUID_DESC_TYPE = 3,
		TEXT_STR_DESC_TYPE = 4,
		BOOLEAN_DESC_TYPE = 5,
		DATA_ELE_SEQ_DESC_TYPE = 6,
		DATA_ELE_ALT_DESC_TYPE = 7,
		URL_DESC_TYPE = 8,
		};

		inline std::string sdp_attr_type_text(const unsigned& type) {
		switch (type) {
		CASE_RETURN_TEXT(NIL_DESC_TYPE);
		CASE_RETURN_TEXT(UINT_DESC_TYPE);
		CASE_RETURN_TEXT(TWO_COMP_INT_DESC_TYPE);
		CASE_RETURN_TEXT(UUID_DESC_TYPE);
		CASE_RETURN_TEXT(TEXT_STR_DESC_TYPE);
		CASE_RETURN_TEXT(BOOLEAN_DESC_TYPE);
		CASE_RETURN_TEXT(DATA_ELE_SEQ_DESC_TYPE);
		CASE_RETURN_TEXT(DATA_ELE_ALT_DESC_TYPE);
		CASE_RETURN_TEXT(URL_DESC_TYPE);
		default:
		return base::StringPrintf("UNKNOWN[%u]", type);
		}
		}

		/* Define all the "Descriptor Size" values.
		*/
		#define SIZE_ONE_BYTE 0
		#define SIZE_TWO_BYTES 1
		#define SIZE_FOUR_BYTES 2
		#define SIZE_EIGHT_BYTES 3
		#define SIZE_SIXTEEN_BYTES 4
		#define SIZE_IN_NEXT_BYTE 5
		#define SIZE_IN_NEXT_WORD 6
		#define SIZE_IN_NEXT_LONG 7
		enum : unsigned {
		SIZE_ONE_BYTE = 0,
		SIZE_TWO_BYTES = 1,
		SIZE_FOUR_BYTES = 2,
		SIZE_EIGHT_BYTES = 3,
		SIZE_SIXTEEN_BYTES = 4,
		SIZE_IN_NEXT_BYTE = 5,
		SIZE_IN_NEXT_WORD = 6,
		SIZE_IN_NEXT_LONG = 7,
		};

		inline std::string sdp_attr_size_text(const unsigned& size) {
		switch (size) {
		CASE_RETURN_TEXT(SIZE_ONE_BYTE);
		CASE_RETURN_TEXT(SIZE_TWO_BYTES);
		CASE_RETURN_TEXT(SIZE_FOUR_BYTES);
		CASE_RETURN_TEXT(SIZE_EIGHT_BYTES);
		CASE_RETURN_TEXT(SIZE_SIXTEEN_BYTES);
		CASE_RETURN_TEXT(SIZE_IN_NEXT_BYTE);
		CASE_RETURN_TEXT(SIZE_IN_NEXT_WORD);
		CASE_RETURN_TEXT(SIZE_IN_NEXT_LONG);
		default:
		return base::StringPrintf("UNKNOWN[%u]", size);
		}
		}

		inline unsigned element_type(const uint8_t& element) { return element >> 3; }

		inline unsigned element_size(const uint8_t& element) { return element & 0x7; }

		/* Language Encoding Constants */
		#define LANG_ID_CODE_ENGLISH ((uint16_t)0x656e) /* "en" */

system/stack/sdp/sdp_utils.cc

+35 −4

Original line number	Diff line number	Diff line
		@@ -23,7 +23,7 @@
		* This file contains SDP utility functions
		*
		******************************************************************************/

		#include <android_bluetooth_flags.h>
		#include <base/logging.h>
		#include <bluetooth/log.h>
		#include <log/log.h>
		@@ -979,9 +979,15 @@ uint8_t* sdpu_extract_attr_seq(uint8_t* p, uint16_t param_len,
		*
		* Function sdpu_get_len_from_type
		*
		* Description This function gets the length
		* Description This function gets the data length given the element
		* header.
		*
		* Returns void
		* @param p Start of the SDP attribute bytestream
		* p_end End of the SDP attribute bytestream
		* type Attribute element header
		* p_len Data size indicated by element header
		*
		* @return pointer to the start of the data or nullptr on failure
		*
		******************************************************************************/
		uint8_t* sdpu_get_len_from_type(uint8_t* p, uint8_t* p_end, uint8_t type,
		@@ -992,7 +998,12 @@ uint8_t* sdpu_get_len_from_type(uint8_t* p, uint8_t* p_end, uint8_t type,

		switch (type & 7) {
		case SIZE_ONE_BYTE:
		if (IS_FLAG_ENABLED(stack_sdp_detect_nil_property_type)) {
		// Return NIL type if appropriate
		*p_len = (type == 0) ? 0 : sizeof(uint8_t);
		} else {
		*p_len = 1;
		}
		break;
		case SIZE_TWO_BYTES:
		*p_len = 2;
		@@ -1652,3 +1663,23 @@ void sdpu_set_avrc_target_features(const tSDP_ATTRIBUTE* p_attr,
		AVRCP_CA_SUPPORT_BITMASK;
		}
		}

		size_t sdp_get_num_records(const tSDP_DISCOVERY_DB& db) {
		size_t num_sdp_records{0};
		const tSDP_DISC_REC* p_rec = db.p_first_rec;
		while (p_rec != nullptr) {
		num_sdp_records++;
		p_rec = p_rec->p_next_rec;
		}
		return num_sdp_records;
		}

		size_t sdp_get_num_attributes(const tSDP_DISC_REC& sdp_disc_rec) {
		size_t num_sdp_attributes{0};
		tSDP_DISC_ATTR* p_attr = sdp_disc_rec.p_first_attr;
		while (p_attr != nullptr) {
		num_sdp_attributes++;
		p_attr = p_attr->p_next_attr;
		}
		return num_sdp_attributes;
		}

system/stack/sdp/sdpint.h

+3 −0

Original line number	Diff line number	Diff line
		@@ -329,4 +329,7 @@ void sdp_save_local_pse_record_attributes(int32_t rfcomm_channel_number,
		uint32_t supported_features,
		uint32_t supported_repositories);

		size_t sdp_get_num_records(const tSDP_DISCOVERY_DB& db);
		size_t sdp_get_num_attributes(const tSDP_DISC_REC& sdp_disc_rec);

		#endif

system/stack/test/sdp/raw_packet.h

0 → 100644

+30 −0

Original line number	Diff line number	Diff line
		/*
		* Copyright 2024 The Android Open Source Project
		*
		* Licensed under the Apache License, Version 2.0 (the "License");
		* you may not use this file except in compliance with the License.
		* You may obtain a copy of the License at
		*
		* http://www.apache.org/licenses/LICENSE-2.0
		*
		* Unless required by applicable law or agreed to in writing, software
		* distributed under the License is distributed on an "AS IS" BASIS,
		* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		* See the License for the specific language governing permissions and
		* limitations under the License.
		*/

		#pragma once

		#include <cstddef>

		namespace bluetooth {
		namespace testing {

		struct raw_packet_t {
		const unsigned char* data;
		size_t len;
		};

		} // namespace testing
		} // namespace bluetooth