Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b141702d authored by Myles Watson's avatar Myles Watson
Browse files

PAN: Fix Use-after-free in bta_pan_data_buf_ind_cback 

Patch from b/67078939

Test: build
Bug: 67110692
Change-Id: I63b857d031c55d3a0754e4101e330843eb422b2a
Merged-In: I63b857d031c55d3a0754e4101e330843eb422b2a
parent ec778d7c

system/bta/pan/bta_pan_act.c

+6 −11
Original line number Diff line number Diff line
@@ -206,6 +206,12 @@ static void bta_pan_data_buf_ind_cback(UINT16 handle, BD_ADDR src, BD_ADDR dst, 
    BT_HDR * p_event;

    BT_HDR *p_new_buf;



    p_scb = bta_pan_scb_by_handle(handle);

    if (p_scb == NULL)

    {

        return;

    }



    if ( sizeof(tBTA_PAN_DATA_PARAMS) > p_buf->offset )

    {

        if (sizeof(BT_HDR) + sizeof(tBTA_PAN_DATA_PARAMS) + p_buf->len >
@@ -213,7 +219,6 @@ static void bta_pan_data_buf_ind_cback(UINT16 handle, BD_ADDR src, BD_ADDR dst, 
            android_errorWriteLog(0x534e4554, "63146237");

            APPL_TRACE_ERROR("%s: received buffer length too large: %d", __func__,

                             p_buf->len);

            GKI_freebuf(p_buf);

            return;

        }
@@ -222,7 +227,6 @@ static void bta_pan_data_buf_ind_cback(UINT16 handle, BD_ADDR src, BD_ADDR dst, 
        if(!p_new_buf)

        {

            APPL_TRACE_WARNING("Cannot get a PAN GKI buffer");

            GKI_freebuf( p_buf );

            return;

        }

        else
@@ -230,7 +234,6 @@ static void bta_pan_data_buf_ind_cback(UINT16 handle, BD_ADDR src, BD_ADDR dst, 
            memcpy( (UINT8 *)(p_new_buf+1)+sizeof(tBTA_PAN_DATA_PARAMS), (UINT8 *)(p_buf+1)+p_buf->offset, p_buf->len );

            p_new_buf->len    = p_buf->len;

            p_new_buf->offset = sizeof(tBTA_PAN_DATA_PARAMS);

            GKI_freebuf( p_buf );

        }

    }

    else
@@ -244,14 +247,6 @@ static void bta_pan_data_buf_ind_cback(UINT16 handle, BD_ADDR src, BD_ADDR dst, 
    ((tBTA_PAN_DATA_PARAMS *)p_new_buf)->ext = ext;

    ((tBTA_PAN_DATA_PARAMS *)p_new_buf)->forward = forward;





    if((p_scb = bta_pan_scb_by_handle(handle)) == NULL)

    {



        GKI_freebuf( p_new_buf );

        return;

    }



    GKI_enqueue(&p_scb->data_queue, p_new_buf);

    if ((p_event = (BT_HDR *) GKI_getbuf(sizeof(BT_HDR))) != NULL)

    {

system/stack/bnep/bnep_main.c

+1 −0
Original line number Diff line number Diff line
@@ -651,6 +651,7 @@ static void bnep_data_ind (UINT16 l2cap_cid, BT_HDR *p_buf) 
    if (bnep_cb.p_data_buf_cb)

    {

        (*bnep_cb.p_data_buf_cb)(p_bcb->handle, p_src_addr, p_dst_addr, protocol, p_buf, fw_ext_present);

        GKI_freebuf (p_buf);

    }

    else if (bnep_cb.p_data_ind_cb)

    {