Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9a1046a4 authored by Cheney Ni's avatar Cheney Ni Committed by Hansong Zhang
Browse files

Checks the SMP length to fix OOB read 

Bug: 111937065
Test: manual
Change-Id: I330880a6e1671d0117845430db4076dfe1aba688
Merged-In: I330880a6e1671d0117845430db4076dfe1aba688
parent c4cfe6c8

system/stack/smp/smp_act.c

+17 −1
Original line number Diff line number Diff line
@@ -1007,6 +1007,14 @@ void smp_proc_enc_info(tSMP_CB *p_cb, tSMP_INT_DATA *p_data) 
    UINT8   *p = (UINT8 *)p_data;



    SMP_TRACE_DEBUG("%s", __func__);



    if (smp_command_has_invalid_parameters(p_cb)) {

        uint8_t reason = SMP_INVALID_PARAMETERS;

        android_errorWriteLog(0x534e4554, "111937065");

        smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);

        return;

    }



    STREAM_TO_ARRAY(p_cb->ltk, p, BT_OCTET16_LEN);



    smp_key_distribution(p_cb, NULL);
@@ -1040,7 +1048,7 @@ void smp_proc_master_id(tSMP_CB *p_cb, tSMP_INT_DATA *p_data) 
}



/*******************************************************************************

** Function     smp_proc_enc_info

** Function     smp_proc_id_info

** Description  process identity information from peer device

*******************************************************************************/

void smp_proc_id_info(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
@@ -1048,6 +1056,14 @@ void smp_proc_id_info(tSMP_CB *p_cb, tSMP_INT_DATA *p_data) 
    UINT8   *p = (UINT8 *)p_data;



    SMP_TRACE_DEBUG("%s", __func__);



    if (smp_command_has_invalid_parameters(p_cb)) {

        uint8_t reason = SMP_INVALID_PARAMETERS;

        android_errorWriteLog(0x534e4554, "111937065");

        smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);

        return;

    }



    STREAM_TO_ARRAY (p_cb->tk, p, BT_OCTET16_LEN);   /* reuse TK for IRK */

    smp_key_distribution_by_transport(p_cb, NULL);

}