Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 26645ec9 authored by Hui Peng's avatar Hui Peng
Browse files

Validate service attr size and type on sdp 

Bug: 263958603
Test: atest net_test_stack_sdp
Ignore-AOSP-First: security
Tag: #security
Change-Id: I1889d4fc2f0e95b2f12678aa2aaf045ec6ef812d
parent 65605ce3

system/stack/sdp/sdp_api.cc

+25 −11
Original line number Diff line number Diff line
@@ -785,8 +785,10 @@ uint8_t SDP_GetNumDiRecords(const tSDP_DISCOVERY_DB* p_db) { 
 *

 ******************************************************************************/

static void SDP_AttrStringCopy(char* dst, const tSDP_DISC_ATTR* p_attr,

                               uint16_t dst_size) {

  if (dst == NULL) return;

                               uint16_t dst_size,

                               uint8_t expected_desc_type) {

  if (dst == NULL || SDP_DISC_ATTR_LEN(p_attr->attr_len_type) != expected_desc_type)

    return;

  if (p_attr) {

    uint16_t len = SDP_DISC_ATTR_LEN(p_attr->attr_len_type);

    if (len > dst_size - 1) {
@@ -836,55 +838,67 @@ uint16_t SDP_GetDiRecord(uint8_t get_record_index, 
    /* ClientExecutableURL is optional */

    p_curr_attr = SDP_FindAttributeInRec(p_curr_record, ATTR_ID_CLIENT_EXE_URL);

    SDP_AttrStringCopy(p_device_info->rec.client_executable_url, p_curr_attr,

                       SDP_MAX_ATTR_LEN);

                       SDP_MAX_ATTR_LEN, URL_DESC_TYPE);



    /* Service Description is optional */

    p_curr_attr =

        SDP_FindAttributeInRec(p_curr_record, ATTR_ID_SERVICE_DESCRIPTION);

    SDP_AttrStringCopy(p_device_info->rec.service_description, p_curr_attr,

                       SDP_MAX_ATTR_LEN);

                       SDP_MAX_ATTR_LEN, TEXT_STR_DESC_TYPE);



    /* DocumentationURL is optional */

    p_curr_attr =

        SDP_FindAttributeInRec(p_curr_record, ATTR_ID_DOCUMENTATION_URL);

    SDP_AttrStringCopy(p_device_info->rec.documentation_url, p_curr_attr,

                       SDP_MAX_ATTR_LEN);

                       SDP_MAX_ATTR_LEN, URL_DESC_TYPE);



    p_curr_attr =

        SDP_FindAttributeInRec(p_curr_record, ATTR_ID_SPECIFICATION_ID);

    if (p_curr_attr)

    if (p_curr_attr &&

        SDP_DISC_ATTR_TYPE(p_curr_attr->attr_len_type) == UINT_DESC_TYPE &&

        SDP_DISC_ATTR_LEN(p_curr_attr->attr_len_type) >= 2)

      p_device_info->spec_id = p_curr_attr->attr_value.v.u16;

    else

      result = SDP_ERR_ATTR_NOT_PRESENT;



    p_curr_attr = SDP_FindAttributeInRec(p_curr_record, ATTR_ID_VENDOR_ID);

    if (p_curr_attr)

    if (p_curr_attr &&

        SDP_DISC_ATTR_TYPE(p_curr_attr->attr_len_type) == UINT_DESC_TYPE &&

        SDP_DISC_ATTR_LEN(p_curr_attr->attr_len_type) >= 2)

      p_device_info->rec.vendor = p_curr_attr->attr_value.v.u16;

    else

      result = SDP_ERR_ATTR_NOT_PRESENT;



    p_curr_attr =

        SDP_FindAttributeInRec(p_curr_record, ATTR_ID_VENDOR_ID_SOURCE);

    if (p_curr_attr)

    if (p_curr_attr &&

        SDP_DISC_ATTR_TYPE(p_curr_attr->attr_len_type) == UINT_DESC_TYPE &&

        SDP_DISC_ATTR_LEN(p_curr_attr->attr_len_type) >= 2)

      p_device_info->rec.vendor_id_source = p_curr_attr->attr_value.v.u16;

    else

      result = SDP_ERR_ATTR_NOT_PRESENT;



    p_curr_attr = SDP_FindAttributeInRec(p_curr_record, ATTR_ID_PRODUCT_ID);

    if (p_curr_attr)

    if (p_curr_attr &&

        SDP_DISC_ATTR_TYPE(p_curr_attr->attr_len_type) == UINT_DESC_TYPE &&

        SDP_DISC_ATTR_LEN(p_curr_attr->attr_len_type) >= 2)

      p_device_info->rec.product = p_curr_attr->attr_value.v.u16;

    else

      result = SDP_ERR_ATTR_NOT_PRESENT;



    p_curr_attr =

        SDP_FindAttributeInRec(p_curr_record, ATTR_ID_PRODUCT_VERSION);

    if (p_curr_attr)

    if (p_curr_attr &&

        SDP_DISC_ATTR_TYPE(p_curr_attr->attr_len_type) == UINT_DESC_TYPE &&

        SDP_DISC_ATTR_LEN(p_curr_attr->attr_len_type) >= 2)

      p_device_info->rec.version = p_curr_attr->attr_value.v.u16;

    else

      result = SDP_ERR_ATTR_NOT_PRESENT;



    p_curr_attr = SDP_FindAttributeInRec(p_curr_record, ATTR_ID_PRIMARY_RECORD);

    if (p_curr_attr)

    if (p_curr_attr &&

        SDP_DISC_ATTR_TYPE(p_curr_attr->attr_len_type) == BOOLEAN_DESC_TYPE &&

        SDP_DISC_ATTR_LEN(p_curr_attr->attr_len_type) >= 1)

      p_device_info->rec.primary_record = (bool)p_curr_attr->attr_value.v.u8;

    else

      result = SDP_ERR_ATTR_NOT_PRESENT;

system/stack/sdp/sdp_utils.cc

+9 −3
Original line number Diff line number Diff line
@@ -251,7 +251,9 @@ void sdpu_log_attribute_metrics(const RawAddress& bda, 
      case UUID_SERVCLASS_AUDIO_SINK: {

        tSDP_DISC_ATTR* p_attr =

            SDP_FindAttributeInRec(p_rec, ATTR_ID_SUPPORTED_FEATURES);

        if (p_attr == nullptr) {

        if (p_attr == nullptr ||

            SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) != UINT_DESC_TYPE ||

            SDP_DISC_ATTR_LEN(p_attr->attr_len_type) < 2) {

          break;

        }

        uint16_t supported_features = p_attr->attr_value.v.u16;
@@ -264,7 +266,9 @@ void sdpu_log_attribute_metrics(const RawAddress& bda, 
      case UUID_SERVCLASS_MESSAGE_ACCESS: {

        tSDP_DISC_ATTR* p_attr =

            SDP_FindAttributeInRec(p_rec, ATTR_ID_MAP_SUPPORTED_FEATURES);

        if (p_attr == nullptr) {

        if (p_attr == nullptr ||

            SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) != UINT_DESC_TYPE ||

            SDP_DISC_ATTR_LEN(p_attr->attr_len_type) < 4) {

          break;

        }

        uint32_t map_supported_features = p_attr->attr_value.v.u32;
@@ -277,7 +281,9 @@ void sdpu_log_attribute_metrics(const RawAddress& bda, 
      case UUID_SERVCLASS_PBAP_PSE: {

        tSDP_DISC_ATTR* p_attr =

            SDP_FindAttributeInRec(p_rec, ATTR_ID_PBAP_SUPPORTED_FEATURES);

        if (p_attr == nullptr) {

        if (p_attr == nullptr ||

            SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) != UINT_DESC_TYPE ||

            SDP_DISC_ATTR_LEN(p_attr->attr_len_type) < 4) {

          break;

        }

        uint32_t pbap_supported_features = p_attr->attr_value.v.u32;