Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 387c18f0 authored by William Escande's avatar William Escande
Browse files

24q2 flag clean: fix_le_pairing_passkey_entry_bypass 

Bug: 321300737
Fix: 321300737
Test: m Bluetooth
Flag: com.android.bluetooth.flags.fix_le_pairing_passkey_entry_bypass
Change-Id: I6303ecbc65ec6a6980f1fcd7c0ec1279ac9f2953
parent f608f965

flags/security.aconfig

+0 −7
Original line number Diff line number Diff line
@@ -15,13 +15,6 @@ flag { 
    bug: "333634398"

}



flag {

    name: "fix_le_pairing_passkey_entry_bypass"

    namespace: "bluetooth"

    description: "Fix the passkey entry bypassing bug in SMP"

    bug: "321300737"

}



flag {

  name: "bta_av_setconfig_rej_type_confusion"

  namespace: "bluetooth"

system/stack/smp/smp_act.cc

+8 −11
Original line number Diff line number Diff line
@@ -681,9 +681,7 @@ void smp_proc_rand(tSMP_CB* p_cb, tSMP_INT_DATA* p_data) { 
    return;

  }



  if (com::android::bluetooth::flags::fix_le_pairing_passkey_entry_bypass()) {

    if (!((p_cb->loc_auth_req & SMP_SC_SUPPORT_BIT) &&

          (p_cb->peer_auth_req & SMP_SC_SUPPORT_BIT)) &&

  if (!((p_cb->loc_auth_req & SMP_SC_SUPPORT_BIT) && (p_cb->peer_auth_req & SMP_SC_SUPPORT_BIT)) &&

      !(p_cb->flags & SMP_PAIR_FLAGS_CMD_CONFIRM_SENT)) {

    // in legacy pairing, the peer should send its rand after

    // we send our confirm
@@ -692,7 +690,6 @@ void smp_proc_rand(tSMP_CB* p_cb, tSMP_INT_DATA* p_data) { 
    smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &smp_int_data);

    return;

  }

  }



  /* save the SRand for comparison */

  STREAM_TO_ARRAY(p_cb->rrand.data(), p, OCTET16_LEN);