Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8ecede4b authored by Hui Peng's avatar Hui Peng
Browse files

Relax the validation on sdp attr size 

Changing from exact size match to greater than or equal
to make the fix less prone to regression.

Bug: 263958603
Test: atest net_test_stack_a2dp_native
Ignore-AOSP-First: security
Tag: #security

Merged-In: I03522897e93af59508efa2f536dd217d48f78110
Change-Id: I03522897e93af59508efa2f536dd217d48f78110
(cherry picked from commit b608afa0)
parent c5bc4c49

system/bta/sdp/bta_sdp_act.cc

+17 −17
Original line number Diff line number Diff line
@@ -50,7 +50,7 @@ static void bta_create_mns_sdp_record(bluetooth_sdp_record* record, 
  p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_MAP_SUPPORTED_FEATURES);

  if (p_attr != NULL) {

    if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) == 4) {

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) >= 4) {

      record->mns.supported_features = p_attr->attr_value.v.u32;

    } else {

      LOG_ERROR("ATTR_ID_MAP_SUPPORTED_FEATURES attr type or size wrong!!");
@@ -84,7 +84,7 @@ static void bta_create_mns_sdp_record(bluetooth_sdp_record* record, 
  p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_GOEP_L2CAP_PSM);

  if (p_attr != NULL) {

    if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) == 2) {

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) >= 2) {

      record->mns.hdr.l2cap_psm = p_attr->attr_value.v.u16;

    } else {

      LOG_ERROR("ATTR_ID_GOEP_L2CAP_PSM attr type or len wrong!!");
@@ -113,7 +113,7 @@ static void bta_create_mas_sdp_record(bluetooth_sdp_record* record, 
  p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_MAS_INSTANCE_ID);

  if (p_attr != NULL) {

    if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) == 1) {

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) >= 1) {

      record->mas.mas_instance_id = p_attr->attr_value.v.u8;

    } else {

      LOG_ERROR("ATTR_ID_MAS_INSTANCE_ID attr type or len wrong!!");
@@ -125,7 +125,7 @@ static void bta_create_mas_sdp_record(bluetooth_sdp_record* record, 
  p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_SUPPORTED_MSG_TYPE);

  if (p_attr != NULL) {

    if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) == 1) {

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) >= 1) {

      record->mas.supported_message_types = p_attr->attr_value.v.u8;

    } else {

      LOG_ERROR("ATTR_ID_SUPPORTED_MSG_TYPE attr type or len wrong!!");
@@ -137,7 +137,7 @@ static void bta_create_mas_sdp_record(bluetooth_sdp_record* record, 
  p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_MAP_SUPPORTED_FEATURES);

  if (p_attr != NULL) {

    if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) == 4) {

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) >= 4) {

      record->mas.supported_features = p_attr->attr_value.v.u32;

    } else {

      LOG_ERROR("ATTR_ID_MAP_SUPPORTED_FEATURES attr type or len wrong!!");
@@ -171,7 +171,7 @@ static void bta_create_mas_sdp_record(bluetooth_sdp_record* record, 
  p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_GOEP_L2CAP_PSM);

  if (p_attr != NULL) {

    if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) == 2) {

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) >= 2) {

      record->mas.hdr.l2cap_psm = p_attr->attr_value.v.u16;

    } else {

      LOG_ERROR("ATTR_ID_GOEP_L2CAP_PSM attr type or len wrong!!");
@@ -199,7 +199,7 @@ static void bta_create_pse_sdp_record(bluetooth_sdp_record* record, 
  p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_SUPPORTED_REPOSITORIES);

  if (p_attr != NULL) {

    if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) == 1) {

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) >= 1) {

      record->pse.supported_repositories = p_attr->attr_value.v.u8;

    } else {

      LOG_ERROR("ATTR_ID_SUPPORTED_REPOSITORIES attr type or len wrong!!");
@@ -210,7 +210,7 @@ static void bta_create_pse_sdp_record(bluetooth_sdp_record* record, 
  p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_PBAP_SUPPORTED_FEATURES);

  if (p_attr != NULL) {

    if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) == 4) {

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) >= 4) {

      record->pse.supported_features = p_attr->attr_value.v.u32;

    } else {

      LOG_ERROR("ATTR_ID_PBAP_SUPPORTED_FEATURES attr type or len wrong!!");
@@ -245,7 +245,7 @@ static void bta_create_pse_sdp_record(bluetooth_sdp_record* record, 
  p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_GOEP_L2CAP_PSM);

  if (p_attr != NULL) {

    if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) == 2) {

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) >= 2) {

      record->pse.hdr.l2cap_psm = p_attr->attr_value.v.u16;

    } else {

      LOG_ERROR("ATTR_ID_GOEP_L2CAP_PSM attr type or len wrong!!");
@@ -294,7 +294,7 @@ static void bta_create_ops_sdp_record(bluetooth_sdp_record* record, 
  p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_GOEP_L2CAP_PSM);

  if (p_attr != NULL) {

    if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) == 2) {

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) >= 2) {

      record->ops.hdr.l2cap_psm = p_attr->attr_value.v.u16;

    } else {

      LOG_ERROR("ATTR_ID_GOEP_L2CAP_PSM attr type or len wrong!!");
@@ -322,7 +322,7 @@ static void bta_create_ops_sdp_record(bluetooth_sdp_record* record, 
      for (p_sattr = p_attr->attr_value.v.p_sub_attr; p_sattr != NULL;

           p_sattr = p_sattr->p_next_attr) {

        if ((SDP_DISC_ATTR_TYPE(p_sattr->attr_len_type) == UINT_DESC_TYPE) &&

            (SDP_DISC_ATTR_LEN(p_sattr->attr_len_type) == 1)) {

            (SDP_DISC_ATTR_LEN(p_sattr->attr_len_type) >= 1)) {

          if (count == sizeof(record->ops.supported_formats_list)) {

            APPL_TRACE_ERROR(

                "%s() - supported_formats_list - count overflow - "
@@ -407,7 +407,7 @@ static void bta_create_dip_sdp_record(bluetooth_sdp_record* record, 
      SDP_FindAttributeInRec(p_rec, ATTR_ID_SPECIFICATION_ID);

  if (p_attr != nullptr) {

    if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) == 2) {

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) >= 2) {

      record->dip.spec_id = p_attr->attr_value.v.u16;

    } else {

      LOG_ERROR("ATTR_ID_SPECIFICATION_ID attr type or len wrong!!");
@@ -419,7 +419,7 @@ static void bta_create_dip_sdp_record(bluetooth_sdp_record* record, 
  p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_VENDOR_ID);

  if (p_attr != nullptr) {

    if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) == 2) {

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) >= 2) {

      record->dip.vendor = p_attr->attr_value.v.u16;

    } else {

      LOG_ERROR("ATTR_ID_VENDOR_ID attr type or len wrong!!");
@@ -432,7 +432,7 @@ static void bta_create_dip_sdp_record(bluetooth_sdp_record* record, 
      SDP_FindAttributeInRec(p_rec, ATTR_ID_VENDOR_ID_SOURCE);

  if (p_attr != nullptr) {

    if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) == 2) {

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) >= 2) {

      record->dip.vendor_id_source = p_attr->attr_value.v.u16;

    } else {

      LOG_ERROR("ATTR_ID_VENDOR_ID_SOURCE attr type or len wrong!!");
@@ -444,7 +444,7 @@ static void bta_create_dip_sdp_record(bluetooth_sdp_record* record, 
  p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_PRODUCT_ID);

  if (p_attr != nullptr) {

    if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) == 2) {

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) >= 2) {

      record->dip.product = p_attr->attr_value.v.u16;

    } else {

      LOG_ERROR("ATTR_ID_PRODUCT_ID attr type or len wrong!!");
@@ -458,7 +458,7 @@ static void bta_create_dip_sdp_record(bluetooth_sdp_record* record, 


  if (p_attr != nullptr) {

    if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) == 2) {

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) >= 2) {

      record->dip.version = p_attr->attr_value.v.u16;

    } else {

      LOG_ERROR("ATTR_ID_PRODUCT_VERSION attr type or len wrong!!");
@@ -470,7 +470,7 @@ static void bta_create_dip_sdp_record(bluetooth_sdp_record* record, 
  p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_PRIMARY_RECORD);

  if (p_attr != nullptr) {

    if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == BOOLEAN_DESC_TYPE &&

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) == 1) {

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) >= 1) {

      record->dip.primary_record = !(!p_attr->attr_value.v.u8);

    } else {

      LOG_ERROR("ATTR_ID_PRIMARY_RECORD attr type or len wrong!!");

system/bta/test/bta_dip_test.cc

+2 −1
Original line number Diff line number Diff line
@@ -178,6 +178,7 @@ TEST_F(BtaDipTest, test_invalid_size_checks) { 
  g_attr_vendor_product_version.attr_len_type = (UINT_DESC_TYPE<<12)|1;

  g_attr_vendor_product_version.attr_value.v.u16 = 0x0100;



  // size greater than 1 is accepted

  g_attr_vendor_product_primary_record.attr_len_type = (BOOLEAN_DESC_TYPE<<12)|2;

  g_attr_vendor_product_primary_record.attr_value.v.u8 = 1;
@@ -188,7 +189,7 @@ TEST_F(BtaDipTest, test_invalid_size_checks) { 
  ASSERT_EQ(record.dip.vendor_id_source, 0);

  ASSERT_EQ(record.dip.product, 0);

  ASSERT_EQ(record.dip.version, 0);

  ASSERT_EQ(record.dip.primary_record, false);

  ASSERT_EQ(record.dip.primary_record, true);

}

system/stack/a2dp/a2dp_api.cc

+1 −1
Original line number Diff line number Diff line
@@ -116,7 +116,7 @@ static void a2dp_sdp_cback(tSDP_STATUS status) { 
      if ((p_attr = SDP_FindAttributeInRec(

               p_rec, ATTR_ID_SUPPORTED_FEATURES)) != NULL) {

        if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&

            SDP_DISC_ATTR_LEN(p_attr->attr_len_type) == 2) {

            SDP_DISC_ATTR_LEN(p_attr->attr_len_type) >= 2) {

          a2dp_svc.features = p_attr->attr_value.v.u16;

        } else {

          LOG_ERROR("ATTR_ID_SUPPORTED_FEATURES attr type not STR!!");