Merge "Checks the SMP length to fix OOB read" into oc-dev (63085c77) · Commits · e / os / android_packages_modules_Bluetooth

system/stack/smp/smp_act.cc

+18 −1

Original line number	Original line	Diff line number	Diff line
	@@ -16,6 +16,7 @@
	*		*
	******************************************************************************/		******************************************************************************/

			#include <log/log.h>
	#include <string.h>		#include <string.h>
	#include "btif_common.h"		#include "btif_common.h"
	#include "device/include/interop.h"		#include "device/include/interop.h"
	@@ -910,6 +911,14 @@ void smp_proc_enc_info(tSMP_CB* p_cb, tSMP_INT_DATA* p_data) {
	uint8_t* p = (uint8_t*)p_data;		uint8_t* p = (uint8_t*)p_data;

	SMP_TRACE_DEBUG("%s", __func__);		SMP_TRACE_DEBUG("%s", __func__);

			if (smp_command_has_invalid_parameters(p_cb)) {
			uint8_t reason = SMP_INVALID_PARAMETERS;
			android_errorWriteLog(0x534e4554, "111937065");
			smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
			return;
			}

	STREAM_TO_ARRAY(p_cb->ltk, p, BT_OCTET16_LEN);		STREAM_TO_ARRAY(p_cb->ltk, p, BT_OCTET16_LEN);

	smp_key_distribution(p_cb, NULL);		smp_key_distribution(p_cb, NULL);
	@@ -950,13 +959,21 @@ void smp_proc_master_id(tSMP_CB* p_cb, tSMP_INT_DATA* p_data) {
	}		}

	/*******************************************************************************		/*******************************************************************************
	* Function smp_proc_enc_info		* Function smp_proc_id_info
	* Description process identity information from peer device		* Description process identity information from peer device
	******************************************************************************/		******************************************************************************/
	void smp_proc_id_info(tSMP_CB* p_cb, tSMP_INT_DATA* p_data) {		void smp_proc_id_info(tSMP_CB* p_cb, tSMP_INT_DATA* p_data) {
	uint8_t* p = (uint8_t*)p_data;		uint8_t* p = (uint8_t*)p_data;

	SMP_TRACE_DEBUG("%s", __func__);		SMP_TRACE_DEBUG("%s", __func__);

			if (smp_command_has_invalid_parameters(p_cb)) {
			uint8_t reason = SMP_INVALID_PARAMETERS;
			android_errorWriteLog(0x534e4554, "111937065");
			smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
			return;
			}

	STREAM_TO_ARRAY(p_cb->tk, p, BT_OCTET16_LEN); /* reuse TK for IRK */		STREAM_TO_ARRAY(p_cb->tk, p, BT_OCTET16_LEN); /* reuse TK for IRK */
	smp_key_distribution_by_transport(p_cb, NULL);		smp_key_distribution_by_transport(p_cb, NULL);
	}		}