Commit 286fa983 authored Jul 20, 2020 by Venkata Jagadeesh Garaga Committed by Chris Manton Apr 14, 2021

Fix Stack-buffer-over-flow while accessing remote device name

Issue:
During authentication timeout, if remote device name is invalid.
A two byte placeholder remote name is passed to callback to intimate
authentication failure. Callback is trying to access 248 bytes
of remote device name from the passed remote name which is of
two bytes. Mismatch of length between passed remote name and
accessed remote device name leads to buffer-over-flow

Fix:
Replaced remote device name to an array of 248 bytes from
two bytes array.

Test:Basic bluetooth pairing
Test:gd/cert/run
Bug: 161663998
Tag: #stability
Sponsor:cmanton@

Change-Id: I0f45a0cf4b1a12c874c2c1fe4dc165c76dc5ae90

parent f7f31e4b

system/stack/btm/btm_sec.cc

+1 −1

Original line number	Diff line number	Diff line
		@@ -3928,7 +3928,7 @@ static void btm_sec_pairing_timeout(UNUSED_ATTR void* data) {
		tBTM_AUTH_REQ auth_req = (btm_cb.devcb.loc_io_caps == BTM_IO_CAP_NONE)
		? BTM_AUTH_AP_NO
		: BTM_AUTH_AP_YES;
		uint8_t name[2];
		BD_NAME name;

		p_dev_rec = btm_find_dev(p_cb->pairing_bda);