Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit adf06fb6 authored by Hui Peng's avatar Hui Peng
Browse files

Fix an OOB bug in btm_create_conn_cancel_complete 

Bug: 260568245
Test: manual
Tag: #security
Ignore-AOSP-First: security
Merged-In: I6cddf5189dbc34ce8346167ec04cb50c936898cf
Change-Id: I6cddf5189dbc34ce8346167ec04cb50c936898cf
parent 362a9148

system/stack/btm/btm_sec.cc

+7 −1
Original line number Diff line number Diff line
@@ -2045,8 +2045,14 @@ static void btm_sec_bond_cancel_complete(void) { 
 * Returns          void

 *

 ******************************************************************************/

void btm_create_conn_cancel_complete(const uint8_t* p) {

void btm_create_conn_cancel_complete(const uint8_t* p, uint16_t evt_len) {

  uint8_t status;



  if (evt_len < 1 + BD_ADDR_LEN) {

     BTM_TRACE_ERROR("%s malformatted event packet, too short", __func__);

     return;

  }



  STREAM_TO_UINT8(status, p);

  RawAddress bd_addr;

  STREAM_TO_BDADDR(bd_addr, p);

system/stack/btm/btm_sec.h

+1 −1
Original line number Diff line number Diff line
@@ -454,7 +454,7 @@ void btm_sec_conn_req(const RawAddress& bda, uint8_t* dc); 
 * Returns          void

 *

 ******************************************************************************/

void btm_create_conn_cancel_complete(const uint8_t* p);

void btm_create_conn_cancel_complete(const uint8_t* p, uint16_t evt_len);



/*******************************************************************************

 *

system/stack/btu/btu_hcif.cc

+1 −1
Original line number Diff line number Diff line
@@ -1216,7 +1216,7 @@ static void btu_hcif_hdl_command_complete(uint16_t opcode, uint8_t* p, 
      break;



    case HCI_CREATE_CONNECTION_CANCEL:

      btm_create_conn_cancel_complete(p);

      btm_create_conn_cancel_complete(p, evt_len);

      break;



    case HCI_READ_LOCAL_OOB_DATA:

system/stack/include/sec_hci_link_interface.h

+1 −1
Original line number Diff line number Diff line
@@ -26,7 +26,7 @@ 
// This header contains functions for HCIF-Security Management to invoke

//



void btm_create_conn_cancel_complete(const uint8_t* p);

void btm_create_conn_cancel_complete(const uint8_t* p, uint16_t evt_len);

void btm_io_capabilities_req(const RawAddress& p);

void btm_io_capabilities_rsp(const uint8_t* p);

void btm_proc_sp_req_evt(tBTM_SP_EVT event, const uint8_t* p);

system/test/mock/mock_stack_btm_sec.cc

+1 −1
Original line number Diff line number Diff line
@@ -239,7 +239,7 @@ void BTM_SetPinType(uint8_t pin_type, PIN_CODE pin_code, uint8_t pin_code_len) { 
void NotifyBondingCanceled(tBTM_STATUS btm_status) {

  mock_function_count_map[__func__]++;

}

void btm_create_conn_cancel_complete(const uint8_t* p) {

void btm_create_conn_cancel_complete(const uint8_t* p, uint16_t evt_len) {

  mock_function_count_map[__func__]++;

}

void btm_io_capabilities_req(const RawAddress& p) {