Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 606824af authored by Hui Peng's avatar Hui Peng
Browse files

Fix an OOB bug in btm_read_tx_power_complete 

Bug: 260568083
Test: manual
Tag: #security
Ignore-AOSP-First: security
Merged-In: I47f4806743b5837f4d7de774eafc95824b0abdd6
Change-Id: I47f4806743b5837f4d7de774eafc95824b0abdd6
parent 45e8d2dc

system/stack/acl/btm_acl.cc

+19 −1
Original line number Diff line number Diff line
@@ -1756,7 +1756,7 @@ void btm_read_tx_power_timeout(UNUSED_ATTR void* data) { 
 * Returns          void

 *

 ******************************************************************************/

void btm_read_tx_power_complete(uint8_t* p, bool is_ble) {

void btm_read_tx_power_complete(uint8_t* p, uint16_t evt_len, bool is_ble) {

  tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_tx_power_cmpl_cb;

  tBTM_TX_POWER_RESULT result;
@@ -1765,6 +1765,10 @@ void btm_read_tx_power_complete(uint8_t* p, bool is_ble) { 


  /* If there was a registered callback, call it */

  if (p_cb) {

    if (evt_len < 1) {

      goto err_out;

    }



    STREAM_TO_UINT8(result.hci_status, p);



    if (result.hci_status == HCI_SUCCESS) {
@@ -1772,6 +1776,11 @@ void btm_read_tx_power_complete(uint8_t* p, bool is_ble) { 


      if (!is_ble) {

        uint16_t handle;



        if (evt_len < 4) {

          goto err_out;

        }



        STREAM_TO_UINT16(handle, p);

        STREAM_TO_UINT8(result.tx_power, p);
@@ -1780,6 +1789,10 @@ void btm_read_tx_power_complete(uint8_t* p, bool is_ble) { 
          result.rem_bda = p_acl_cb->remote_addr;

        }

      } else {

        if (evt_len < 2) {

          goto err_out;

        }



        STREAM_TO_UINT8(result.tx_power, p);

        result.rem_bda = btm_cb.devcb.read_tx_pwr_addr;

      }
@@ -1793,6 +1806,11 @@ void btm_read_tx_power_complete(uint8_t* p, bool is_ble) { 


    (*p_cb)(&result);

  }



  return;



 err_out:

  LOG_ERROR("Bogus event packet, too short");

}



/*******************************************************************************

system/stack/btu/btu_hcif.cc

+2 −2
Original line number Diff line number Diff line
@@ -1212,7 +1212,7 @@ static void btu_hcif_hdl_command_complete(uint16_t opcode, uint8_t* p, 
      break;



    case HCI_READ_TRANSMIT_POWER_LEVEL:

      btm_read_tx_power_complete(p, false);

      btm_read_tx_power_complete(p, evt_len, false);

      break;



    case HCI_CREATE_CONNECTION_CANCEL:
@@ -1233,7 +1233,7 @@ static void btu_hcif_hdl_command_complete(uint16_t opcode, uint8_t* p, 
      break;



    case HCI_BLE_READ_ADV_CHNL_TX_POWER:

      btm_read_tx_power_complete(p, true);

      btm_read_tx_power_complete(p, evt_len, true);

      break;



    case HCI_BLE_WRITE_ADV_ENABLE:

system/stack/include/acl_hci_link_interface.h

+1 −1
Original line number Diff line number Diff line
@@ -63,7 +63,7 @@ void btm_read_remote_version_complete(tHCI_STATUS status, uint16_t handle, 
                                      uint16_t manufacturer,

                                      uint16_t lmp_subversion);

void btm_read_rssi_complete(uint8_t* p);

void btm_read_tx_power_complete(uint8_t* p, bool is_ble);

void btm_read_tx_power_complete(uint8_t* p, uint16_t evt_len, bool is_ble);



void acl_rcv_acl_data(BT_HDR* p_msg);

void acl_link_segments_xmitted(BT_HDR* p_msg);

system/test/mock/mock_stack_acl.cc

+2 −2
Original line number Diff line number Diff line
@@ -673,9 +673,9 @@ void btm_read_rssi_timeout(UNUSED_ATTR void* data) { 
  mock_function_count_map[__func__]++;

  test::mock::stack_acl::btm_read_rssi_timeout(data);

}

void btm_read_tx_power_complete(uint8_t* p, bool is_ble) {

void btm_read_tx_power_complete(uint8_t* p, uint16_t evt_len, bool is_ble) {

  mock_function_count_map[__func__]++;

  test::mock::stack_acl::btm_read_tx_power_complete(p, is_ble);

  test::mock::stack_acl::btm_read_tx_power_complete(p, evt_len, is_ble);

}

void btm_read_tx_power_timeout(UNUSED_ATTR void* data) {

  mock_function_count_map[__func__]++;

system/test/mock/mock_stack_acl.h

+5 −3
Original line number Diff line number Diff line
@@ -1206,9 +1206,11 @@ extern struct btm_read_rssi_timeout btm_read_rssi_timeout; 
// Params: uint8_t* p, bool is_ble

// Returns: void

struct btm_read_tx_power_complete {

  std::function<void(uint8_t* p, bool is_ble)> body{

      [](uint8_t* p, bool is_ble) { ; }};

  void operator()(uint8_t* p, bool is_ble) { body(p, is_ble); };

  std::function<void(uint8_t* p, uint16_t evt_len, bool is_ble)> body{

      [](uint8_t* p, uint16_t evt_len, bool is_ble) { ; }};

  void operator()(uint8_t* p, uint16_t evt_len, bool is_ble) {

    body(p, evt_len, is_ble);

  };

};

extern struct btm_read_tx_power_complete btm_read_tx_power_complete;

// Name: btm_read_tx_power_timeout