Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b084b9b8 authored by Brian Delwiche's avatar Brian Delwiche Committed by Automerger Merge Worker
Browse files

Fix OOB writes in gatt_sr.cc am: 2fc3087b am: 3110c47f 

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/29692967



Change-Id: I515d5d7ff2e030f7a88e65c94a2b92174abe3e25
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 7f373e0f 3110c47f

system/stack/gatt/gatt_sr.cc

+21 −0
Original line number Diff line number Diff line
@@ -733,6 +733,11 @@ void gatts_process_primary_service_req(tGATT_TCB& tcb, uint16_t cid, 


  uint16_t payload_size = gatt_tcb_get_payload_size_tx(tcb, cid);



  // This can happen if the channel is already closed.

  if (payload_size == 0) {

    return;

  }



  uint16_t msg_len =

      (uint16_t)(sizeof(BT_HDR) + payload_size + L2CAP_MIN_OFFSET);

  BT_HDR* p_msg = (BT_HDR*)osi_calloc(msg_len);
@@ -768,6 +773,12 @@ static void gatts_process_find_info(tGATT_TCB& tcb, uint16_t cid, 
  }



  uint16_t payload_size = gatt_tcb_get_payload_size_tx(tcb, cid);



  // This can happen if the channel is already closed.

  if (payload_size == 0) {

    return;

  }



  uint16_t buf_len =

      (uint16_t)(sizeof(BT_HDR) + payload_size + L2CAP_MIN_OFFSET);
@@ -902,6 +913,11 @@ static void gatts_process_read_by_type_req(tGATT_TCB& tcb, uint16_t cid, 


  uint16_t payload_size = gatt_tcb_get_payload_size_tx(tcb, cid);



  // This can happen if the channel is already closed.

  if (payload_size == 0) {

    return;

  }



  size_t msg_len = sizeof(BT_HDR) + payload_size + L2CAP_MIN_OFFSET;

  BT_HDR* p_msg = (BT_HDR*)osi_calloc(msg_len);

  uint8_t* p = (uint8_t*)(p_msg + 1) + L2CAP_MIN_OFFSET;
@@ -1049,6 +1065,11 @@ static void gatts_process_read_req(tGATT_TCB& tcb, uint16_t cid, 
                                   uint8_t* p_data) {

  uint16_t payload_size = gatt_tcb_get_payload_size_tx(tcb, cid);



  // This can happen if the channel is already closed.

  if (payload_size == 0) {

    return;

  }



  size_t buf_len = sizeof(BT_HDR) + payload_size + L2CAP_MIN_OFFSET;

  uint16_t offset = 0;