Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9bd576f4 authored by Hui Peng's avatar Hui Peng
Browse files

Fix an OOB bug in BqrVseSubEvt::ParseBqrLinkQualityEvt 

The size of the packet is not checked when
`vendor_cap_supported_version >= kBqrIsoVersion` holds.
This patch adds a check on the size in this code path.

Bug: 242993878
Test: manual
Ignore-AOSP-First: security
Change-Id: I3191701c54b342ef3cf2296de075666b13e3096e
parent 0a8fa7f3

system/btif/include/btif_bqr.h

+2 −0
Original line number Diff line number Diff line
@@ -99,6 +99,8 @@ static constexpr uint16_t kLogDumpEventPerFile = 0x00FF; 
// Total length of all parameters of the link Quality related event except

// Vendor Specific Parameters.

static constexpr uint8_t kLinkQualityParamTotalLen = 48;

// 7.8.116 LE Read ISO Link Quality command

static constexpr uint8_t kISOLinkQualityParamTotalLen = 24;

// Total length of all parameters of the ROOT_INFLAMMATION event except Vendor

// Specific Parameters.

static constexpr uint8_t kRootInflammationParamTotalLen = 3;

system/btif/src/btif_bqr.cc

+21 −7
Original line number Diff line number Diff line
@@ -79,13 +79,27 @@ void BqrVseSubEvt::ParseBqrLinkQualityEvt(uint8_t length, 
  STREAM_TO_UINT32(bqr_link_quality_event_.buffer_underflow_bytes, p_param_buf);



  if (vendor_cap_supported_version >= kBqrIsoVersion) {

    if (length < kLinkQualityParamTotalLen + kISOLinkQualityParamTotalLen) {

      LOG(WARNING) << __func__

                   << ": Parameter total length: " << std::to_string(length)

                   << " is abnormal. "

                   << "vendor_cap_supported_version: "

                   << vendor_cap_supported_version << " "

                   << " (>= "

                   << "kBqrIsoVersion=" << kBqrIsoVersion << "), "

                   << "It should not be shorter than: "

                   << std::to_string(kLinkQualityParamTotalLen +

                                     kISOLinkQualityParamTotalLen);

    } else {

      STREAM_TO_UINT32(bqr_link_quality_event_.tx_total_packets, p_param_buf);

      STREAM_TO_UINT32(bqr_link_quality_event_.tx_unacked_packets, p_param_buf);

      STREAM_TO_UINT32(bqr_link_quality_event_.tx_flushed_packets, p_param_buf);

      STREAM_TO_UINT32(bqr_link_quality_event_.tx_last_subevent_packets,

                       p_param_buf);

      STREAM_TO_UINT32(bqr_link_quality_event_.crc_error_packets, p_param_buf);

    STREAM_TO_UINT32(bqr_link_quality_event_.rx_duplicate_packets, p_param_buf);

      STREAM_TO_UINT32(bqr_link_quality_event_.rx_duplicate_packets,

                       p_param_buf);

    }

  }



  const auto now = system_clock::to_time_t(system_clock::now());