Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit aeebce2f authored by Jakub Pawlowski's avatar Jakub Pawlowski
Browse files

LE advertise data parsing refactor 

* merge BTM_CheckAdvData and BTM_CheckEirData into GetFieldByType
* check wether AD data is properly formatted when the packet is
  received. Some controllers were returning malformed data that
  resulted in stack crashes for BT5 packets.
* add tests to verify the helpers work as expected

Test: added net_test_stack_ad_parser
Bug: 37671082
Change-Id: I49e43d7cf7d0a8ace1ee45d9b14b2b8440096b05
parent 77c6d9f7

system/btif/src/btif_ble_scanner.cc

+5 −3
Original line number Diff line number Diff line
@@ -34,6 +34,7 @@ 


#include <hardware/bt_gatt.h>



#include "advertise_data_parser.h"

#include "bta_api.h"

#include "bta_closure_api.h"

#include "bta_gatt_api.h"
@@ -147,11 +148,11 @@ void bta_scan_results_cb_impl(bt_bdaddr_t bd_addr, tBT_DEVICE_TYPE device_type, 
  bt_device_type_t dev_type;

  bt_property_t properties;



  const uint8_t* p_eir_remote_name = BTM_CheckAdvData(

  const uint8_t* p_eir_remote_name = AdvertiseDataParser::GetFieldByType(

      value, BTM_EIR_COMPLETE_LOCAL_NAME_TYPE, &remote_name_len);



  if (p_eir_remote_name == NULL) {

    p_eir_remote_name = BTM_CheckAdvData(

    p_eir_remote_name = AdvertiseDataParser::GetFieldByType(

        value, BT_EIR_SHORTENED_LOCAL_NAME_TYPE, &remote_name_len);

  }
@@ -212,7 +213,8 @@ void bta_scan_results_cb(tBTA_DM_SEARCH_EVT event, tBTA_DM_SEARCH* p_data) { 
    value.insert(value.begin(), p_data->inq_res.p_eir,

                 p_data->inq_res.p_eir + p_data->inq_res.eir_len);



    if (BTM_CheckAdvData(value, BTM_EIR_COMPLETE_LOCAL_NAME_TYPE, &len)) {

    if (AdvertiseDataParser::GetFieldByType(

            value, BTM_EIR_COMPLETE_LOCAL_NAME_TYPE, &len)) {

      p_data->inq_res.remt_name_not_required = true;

    }

  }

system/btif/src/btif_dm.cc

+4 −6
Original line number Diff line number Diff line
@@ -43,6 +43,7 @@ 


#include <hardware/bluetooth.h>



#include "advertise_data_parser.h"

#include "bdaddr.h"

#include "bt_common.h"

#include "bta_closure_api.h"
@@ -52,11 +53,8 @@ 
#include "btif_dm.h"

#include "btif_hd.h"

#include "btif_hh.h"

#include "btif_hh.h"

#include "btif_sdp.h"

#include "btif_storage.h"

#include "btif_storage.h"

#include "btif_util.h"

#include "btif_util.h"

#include "btu.h"

#include "device/include/controller.h"
@@ -344,16 +342,16 @@ bt_status_t btif_in_execute_service_request(tBTA_SERVICE_ID service_id, 
static bool check_eir_remote_name(tBTA_DM_SEARCH* p_search_data,

                                  uint8_t* p_remote_name,

                                  uint8_t* p_remote_name_len) {

  uint8_t* p_eir_remote_name = NULL;

  const uint8_t* p_eir_remote_name = NULL;

  uint8_t remote_name_len = 0;



  /* Check EIR for remote name and services */

  if (p_search_data->inq_res.p_eir) {

    p_eir_remote_name = BTM_CheckEirData(

    p_eir_remote_name = AdvertiseDataParser::GetFieldByType(

        p_search_data->inq_res.p_eir, p_search_data->inq_res.eir_len,

        BTM_EIR_COMPLETE_LOCAL_NAME_TYPE, &remote_name_len);

    if (!p_eir_remote_name) {

      p_eir_remote_name = BTM_CheckEirData(

      p_eir_remote_name = AdvertiseDataParser::GetFieldByType(

          p_search_data->inq_res.p_eir, p_search_data->inq_res.eir_len,

          BTM_EIR_SHORTENED_LOCAL_NAME_TYPE, &remote_name_len);

    }

system/stack/Android.bp

+17 −0
Original line number Diff line number Diff line
@@ -272,3 +272,20 @@ cc_test { 
        "libgmock",

    ],

}



// Bluetooth stack advertise data parsing unit tests for target

// =============================================================

cc_test {

    name: "net_test_stack_ad_parser",

    defaults: ["fluoride_defaults"],

    local_include_dirs: [

        "include",

    ],

    srcs: [

        "test/ad_parser_unittest.cc",

    ],

    static_libs: [

        "liblog",

        "libgmock",

    ],

}

system/stack/btm/btm_ble_gap.cc

+15 −41
Original line number Diff line number Diff line
@@ -43,6 +43,7 @@ 
#include "hcimsgs.h"

#include "osi/include/osi.h"



#include "advertise_data_parser.h"

#include "btm_ble_int.h"

#include "gatt_int.h"

#include "gattdefs.h"
@@ -1093,41 +1094,6 @@ void BTM_BleWriteScanRsp(uint8_t* data, uint8_t length, 
  p_adv_data_cback(BTM_SUCCESS);

}



/**

 * This function returns a pointer inside the |adv| where a field of |type| is

 * located, together with it' length in |p_length|

 **/

const uint8_t* BTM_CheckAdvData(std::vector<uint8_t> const& adv, uint8_t type,

                                uint8_t* p_length) {

  BTM_TRACE_API("%s: type=0x%02x", __func__, type);



  if (adv.empty()) {

    *p_length = 0;

    return NULL;

  }



  size_t position = 0;

  uint8_t length = adv[position];



  while (length > 0 && (position < adv.size())) {

    uint8_t adv_type = adv[position + 1];



    if (adv_type == type) {

      /* length doesn't include itself */

      *p_length = length - 1; /* minus the length of type */

      return adv.data() + position + 2;

    }



    position += length + 1; /* skip the length of data */

    if (position >= adv.size()) break;



    length = adv[position];

  }



  *p_length = 0;

  return NULL;

}



/*******************************************************************************

 *

 * Function         BTM__BLEReadDiscoverability
@@ -1707,8 +1673,8 @@ uint8_t btm_ble_is_discoverable(BD_ADDR bda, 
  }



  if (!adv_data.empty()) {

    const uint8_t* p_flag =

        BTM_CheckAdvData(adv_data, BTM_BLE_AD_TYPE_FLAG, &data_len);

    const uint8_t* p_flag = AdvertiseDataParser::GetFieldByType(

        adv_data, BTM_BLE_AD_TYPE_FLAG, &data_len);

    if (p_flag != NULL) {

      flag = *p_flag;
@@ -1893,7 +1859,8 @@ void btm_ble_update_inq_result(tINQ_DB_ENT* p_i, uint8_t addr_type, BD_ADDR bda, 
  p_i->inq_count = p_inq->inq_counter; /* Mark entry for current inquiry */



  if (!data.empty()) {

    const uint8_t* p_flag = BTM_CheckAdvData(data, BTM_BLE_AD_TYPE_FLAG, &len);

    const uint8_t* p_flag =

        AdvertiseDataParser::GetFieldByType(data, BTM_BLE_AD_TYPE_FLAG, &len);

    if (p_flag != NULL) p_cur->flag = *p_flag;

  }
@@ -1905,13 +1872,14 @@ void btm_ble_update_inq_result(tINQ_DB_ENT* p_i, uint8_t addr_type, BD_ADDR bda, 
     * Otherwise fall back to trying to infer if it is a HID device based on the

     * service class.

     */

    const uint8_t* p_uuid16 =

        BTM_CheckAdvData(data, BTM_BLE_AD_TYPE_APPEARANCE, &len);

    const uint8_t* p_uuid16 = AdvertiseDataParser::GetFieldByType(

        data, BTM_BLE_AD_TYPE_APPEARANCE, &len);

    if (p_uuid16 && len == 2) {

      btm_ble_appearance_to_cod((uint16_t)p_uuid16[0] | (p_uuid16[1] << 8),

                                p_cur->dev_class);

    } else {

      p_uuid16 = BTM_CheckAdvData(data, BTM_BLE_AD_TYPE_16SRV_CMPL, &len);

      p_uuid16 = AdvertiseDataParser::GetFieldByType(

          data, BTM_BLE_AD_TYPE_16SRV_CMPL, &len);

      if (p_uuid16 != NULL) {

        uint8_t i;

        for (i = 0; i + 2 <= len; i = i + 2) {
@@ -2162,6 +2130,12 @@ static void btm_ble_process_adv_pkt_cont( 
    return;

  }



  if (!AdvertiseDataParser::IsValid(adv_data)) {

    DVLOG(1) << __func__ << "Dropping bad advertisement packet: "

             << base::HexEncode(adv_data.data(), adv_data.size());

    return;

  }



  tINQ_DB_ENT* p_i = btm_inq_db_find(bda);



  /* Check if this address has already been processed for this inquiry */

system/stack/btm/btm_inq.cc

+20 −48
Original line number Diff line number Diff line
@@ -34,6 +34,7 @@ 
#include "osi/include/osi.h"

#include "osi/include/time.h"



#include "advertise_data_parser.h"

#include "bt_common.h"

#include "bt_types.h"

#include "btm_api.h"
@@ -118,10 +119,12 @@ static void btm_clr_inq_result_flt(void); 


static uint8_t btm_convert_uuid_to_eir_service(uint16_t uuid16);

static void btm_set_eir_uuid(uint8_t* p_eir, tBTM_INQ_RESULTS* p_results);

static uint8_t* btm_eir_get_uuid_list(uint8_t* p_eir, size_t eir_len,

                                      uint8_t uuid_size, uint8_t* p_num_uuid,

static const uint8_t* btm_eir_get_uuid_list(uint8_t* p_eir, size_t eir_len,

                                            uint8_t uuid_size,

                                            uint8_t* p_num_uuid,

                                            uint8_t* p_uuid_list_type);

static uint16_t btm_convert_uuid_to_uuid16(uint8_t* p_uuid, uint8_t uuid_size);

static uint16_t btm_convert_uuid_to_uuid16(const uint8_t* p_uuid,

                                           uint8_t uuid_size);



/*******************************************************************************

 *
@@ -2288,41 +2291,6 @@ tBTM_STATUS BTM_WriteEIR(BT_HDR* p_buff) { 
  }

}



/**

 * This function returns a pointer inside the |p_eir| array of length |eir_len|

 * where a field of |type| is located, together with its length in |p_length|

 */

uint8_t* BTM_CheckEirData(uint8_t* p_eir, size_t eir_len, uint8_t type,

                          uint8_t* p_length) {

  BTM_TRACE_API("%s: type=0x%02x", __func__, type);



  if (eir_len == 0) {

    *p_length = 0;

    return NULL;

  }



  size_t position = 0;

  uint8_t length = p_eir[position];



  while (length > 0 && (position < eir_len)) {

    uint8_t adv_type = p_eir[position + 1];



    if (adv_type == type) {

      /* length doesn't include itself */

      *p_length = length - 1; /* minus the length of type */

      return p_eir + position + 2;

    }



    position += length + 1; /* skip the length of data */

    if (position >= eir_len) break;



    length = p_eir[position];

  }



  *p_length = 0;

  return NULL;

}



/*******************************************************************************

 *

 * Function         btm_convert_uuid_to_eir_service
@@ -2500,7 +2468,7 @@ uint8_t BTM_GetEirSupportedServices(uint32_t* p_eir_uuid, uint8_t** p, 
uint8_t BTM_GetEirUuidList(uint8_t* p_eir, size_t eir_len, uint8_t uuid_size,

                           uint8_t* p_num_uuid, uint8_t* p_uuid_list,

                           uint8_t max_num_uuid) {

  uint8_t* p_uuid_data;

  const uint8_t* p_uuid_data;

  uint8_t type;

  uint8_t yy, xx;

  uint16_t* p_uuid16 = (uint16_t*)p_uuid_list;
@@ -2561,10 +2529,11 @@ uint8_t BTM_GetEirUuidList(uint8_t* p_eir, size_t eir_len, uint8_t uuid_size, 
 *                  beginning of UUID list in EIR - otherwise

 *

 ******************************************************************************/

static uint8_t* btm_eir_get_uuid_list(uint8_t* p_eir, size_t eir_len,

                                      uint8_t uuid_size, uint8_t* p_num_uuid,

static const uint8_t* btm_eir_get_uuid_list(uint8_t* p_eir, size_t eir_len,

                                            uint8_t uuid_size,

                                            uint8_t* p_num_uuid,

                                            uint8_t* p_uuid_list_type) {

  uint8_t* p_uuid_data;

  const uint8_t* p_uuid_data;

  uint8_t complete_type, more_type;

  uint8_t uuid_len;
@@ -2587,9 +2556,11 @@ static uint8_t* btm_eir_get_uuid_list(uint8_t* p_eir, size_t eir_len, 
      break;

  }



  p_uuid_data = BTM_CheckEirData(p_eir, eir_len, complete_type, &uuid_len);

  p_uuid_data = AdvertiseDataParser::GetFieldByType(p_eir, eir_len,

                                                    complete_type, &uuid_len);

  if (p_uuid_data == NULL) {

    p_uuid_data = BTM_CheckEirData(p_eir, eir_len, more_type, &uuid_len);

    p_uuid_data = AdvertiseDataParser::GetFieldByType(p_eir, eir_len, more_type,

                                                      &uuid_len);

    *p_uuid_list_type = more_type;

  } else {

    *p_uuid_list_type = complete_type;
@@ -2612,7 +2583,8 @@ static uint8_t* btm_eir_get_uuid_list(uint8_t* p_eir, size_t eir_len, 
 *                  UUID 16-bit - otherwise

 *

 ******************************************************************************/

static uint16_t btm_convert_uuid_to_uuid16(uint8_t* p_uuid, uint8_t uuid_size) {

static uint16_t btm_convert_uuid_to_uuid16(const uint8_t* p_uuid,

                                           uint8_t uuid_size) {

  static const uint8_t base_uuid[LEN_UUID_128] = {

      0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,

      0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
@@ -2668,7 +2640,7 @@ static uint16_t btm_convert_uuid_to_uuid16(uint8_t* p_uuid, uint8_t uuid_size) { 
 *

 ******************************************************************************/

void btm_set_eir_uuid(uint8_t* p_eir, tBTM_INQ_RESULTS* p_results) {

  uint8_t* p_uuid_data;

  const uint8_t* p_uuid_data;

  uint8_t num_uuid;

  uint16_t uuid16;

  uint8_t yy;