Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6759caa4 authored by Ugo Yu's avatar Ugo Yu Committed by android-build-merger
Browse files

Merge "Add packet length check in smp_proc_master_id" into oc-dev am: 5624dbf1 am: 1c732136 

am: 182d68a1

Change-Id: I44ebb7389fa0c4603991b0e7f6aff8ed114556e9
parents dd00d2d1 182d68a1

system/stack/smp/smp_act.cc

+8 −0
Original line number Original line Diff line number Diff line
@@ -929,6 +929,14 @@ void smp_proc_master_id(tSMP_CB* p_cb, tSMP_INT_DATA* p_data) { 
  tBTM_LE_PENC_KEYS le_key;

  tBTM_LE_PENC_KEYS le_key;





  SMP_TRACE_DEBUG("%s", __func__);

  SMP_TRACE_DEBUG("%s", __func__);



  if (p_cb->rcvd_cmd_len < 11) {  // 1(Code) + 2(EDIV) + 8(Rand)

    android_errorWriteLog(0x534e4554, "111937027");

    SMP_TRACE_ERROR("%s: Invalid command length: %d, should be at least 11",

                    __func__, p_cb->rcvd_cmd_len);

    return;

  }



  smp_update_key_mask(p_cb, SMP_SEC_KEY_TYPE_ENC, true);

  smp_update_key_mask(p_cb, SMP_SEC_KEY_TYPE_ENC, true);





  STREAM_TO_UINT16(le_key.ediv, p);

  STREAM_TO_UINT16(le_key.ediv, p);