Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ac6177ae authored by Jakub Pawlowski's avatar Jakub Pawlowski
Browse files

Fix advertise data parsing 

This patch fixes overflow of position variable, and possible read
outside of vector boundaries when parsing advertise data.

Parsing 1004 bytes of hex "112233112233.." was causing infinite loop.

Bug: 30622771
Test: manual
Change-Id: I0d669f7958de73f5d53350fb293ff27fea172f44
parent 6fbe4548

system/stack/btm/btm_ble_gap.cc

+3 −1
Original line number Diff line number Diff line
@@ -1117,7 +1117,7 @@ const uint8_t* BTM_CheckAdvData(std::vector<uint8_t> const& adv, uint8_t type, 
    return NULL;

  }



  uint8_t position = 0;

  size_t position = 0;

  uint8_t length = adv[position];



  while (length > 0 && (position < adv.size())) {
@@ -1130,6 +1130,8 @@ const uint8_t* BTM_CheckAdvData(std::vector<uint8_t> const& adv, uint8_t type, 
    }



    position += length + 1; /* skip the length of data */

    if (position >= adv.size()) break;



    length = adv[position];

  }

system/stack/btm/btm_inq.cc

+3 −1
Original line number Diff line number Diff line
@@ -2318,7 +2318,7 @@ uint8_t* BTM_CheckEirData(uint8_t* p_eir, size_t eir_len, uint8_t type, 
    return NULL;

  }



  uint8_t position = 0;

  size_t position = 0;

  uint8_t length = p_eir[position];



  while (length > 0 && (position < eir_len)) {
@@ -2331,6 +2331,8 @@ uint8_t* BTM_CheckEirData(uint8_t* p_eir, size_t eir_len, uint8_t type, 
    }



    position += length + 1; /* skip the length of data */

    if (position >= eir_len) break;



    length = p_eir[position];

  }