Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9265f654 authored by Ugo Yu's avatar Ugo Yu Committed by Hansong Zhang
Browse files

DO NOT MERGE Add packet length check in smp_proc_master_id 

Bug: 111937027
Test: manual
Change-Id: I2009b6be38f9733931e625379b035e84371fdcaf
parent 88883058

system/stack/smp/smp_act.c

+8 −0
Original line number Diff line number Diff line
@@ -1021,6 +1021,14 @@ void smp_proc_master_id(tSMP_CB *p_cb, tSMP_INT_DATA *p_data) 
    tBTM_LE_PENC_KEYS   le_key;



    SMP_TRACE_DEBUG("%s", __func__);



    if (p_cb->rcvd_cmd_len < 11) {  // 1(Code) + 2(EDIV) + 8(Rand)

        android_errorWriteLog(0x534e4554, "111937027");

        SMP_TRACE_ERROR("%s: Invalid command length: %d, should be at least 11",

                        __func__, p_cb->rcvd_cmd_len);

        return;

    }



    smp_update_key_mask (p_cb, SMP_SEC_KEY_TYPE_ENC, TRUE);



    STREAM_TO_UINT16(le_key.ediv, p);