Fix UAF in sdp_discovery.cc
It is possible with modifications to a client to open two connections against the same SDP discovery database. If this happens, it becomes possible to reference a freed instance of the discovery database in the second connection once the first one is closed. To guard against this, check during discovery if a database has already been allocated, and abort iff it has. Also, add a null check to process_service_search_attr_rsp to guard against unchecked calls to the SDP discovery database. Bug: 291281168 Bug: 356201480 Flag: com.android.bluetooth.flags.btsec_check_valid_discovery_database Test: atest bluetooth_test_gd_unit, net_test_stack_sdp Tag: #security Ignore-AOSP-First: Security (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:27d31199637cbb1b322c8e85195fdaf2bee31da7) Merged-In: Ia08387b6b98c13aca894930e59f8780b17011331 Change-Id: Ia08387b6b98c13aca894930e59f8780b17011331
Loading
Please register or sign in to comment