Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 246f4b06 authored by Alain Michaud's avatar Alain Michaud
Browse files

btm: fixing oob write in multi-adv SetData. 

Fixing size checks when searching to fill in the TX_Power data section.

Bug: b/123292010
Test: ./test/run_unit_tests.sh
Change-Id: If6e7aa40a1a08b098e71ca0ccc8ef66f488571fb
(cherry picked from commit d373161b)
parent 1ef9ad9d

system/stack/btm/btm_ble_multi_adv.cc

+6 −9
Original line number Diff line number Diff line
@@ -728,17 +728,14 @@ class BleAdvertisingManagerImpl 
      data.insert(data.begin(), flags.begin(), flags.end());

    }



    // Find and fill TX Power with the correct value

    if (data.size()) {

      size_t i = 0;

      while (i < data.size()) {

        uint8_t type = data[i + 1];

        if (type == HCI_EIR_TX_POWER_LEVEL_TYPE) {

    // Find and fill TX Power with the correct value.

    // The TX Power section is a 3 byte section.

    for (size_t i = 0; (i + 2) < data.size();) {

      if (data[i + 1] == HCI_EIR_TX_POWER_LEVEL_TYPE) {

        data[i + 2] = adv_inst[inst_id].tx_power;

      }

      i += data[i] + 1;

    }

    }



    VLOG(1) << "data is: " << base::HexEncode(data.data(), data.size());

    DivideAndSendData(