Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e2821752 authored by Hui Peng's avatar Hui Peng
Browse files

Add validation on service attrs in bta_sdp_act.cc 

Bug: 263958603
Test: atest net_test_bta
Ignore-AOSP-First: security
Tag: #security

Merged-In: I59b208d403d6f16a8515b351f4c296f9affdf37b
Change-Id: I59b208d403d6f16a8515b351f4c296f9affdf37b
(cherry picked from commit 66ce4a04)
parent b7c4b272

system/bta/sdp/bta_sdp_act.cc

+191 −46
Original line number Diff line number Diff line
@@ -49,14 +49,27 @@ static void bta_create_mns_sdp_record(bluetooth_sdp_record* record, 


  p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_MAP_SUPPORTED_FEATURES);

  if (p_attr != NULL) {

    if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) == 4) {

      record->mns.supported_features = p_attr->attr_value.v.u32;

    } else {

      LOG_ERROR("ATTR_ID_MAP_SUPPORTED_FEATURES attr type or size wrong!!");

    }

  } else {

      LOG_ERROR("ATTR_ID_MAP_SUPPORTED_FEATURES attr not found!!");

  }



  p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_SERVICE_NAME);

  if (p_attr != NULL) {

    if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == TEXT_STR_DESC_TYPE) {

      record->mns.hdr.service_name_length =

          SDP_DISC_ATTR_LEN(p_attr->attr_len_type);

      record->mns.hdr.service_name = (char*)p_attr->attr_value.v.array;

    } else {

      LOG_ERROR("ATTR_ID_SERVICE_NAME attr type not TEXT_STR_DESC_TYPE!!");

    }

  } else {

      LOG_ERROR("ATTR_ID_SERVICE_NAME attr not found!!");

  }



  if (SDP_FindProfileVersionInRec(p_rec, UUID_SERVCLASS_MAP_PROFILE,
@@ -70,7 +83,14 @@ static void bta_create_mns_sdp_record(bluetooth_sdp_record* record, 


  p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_GOEP_L2CAP_PSM);

  if (p_attr != NULL) {

    if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) == 2) {

      record->mns.hdr.l2cap_psm = p_attr->attr_value.v.u16;

    } else {

      LOG_ERROR("ATTR_ID_GOEP_L2CAP_PSM attr type or len wrong!!");

    }

  } else {

      LOG_ERROR("ATTR_ID_GOEP_L2CAP_PSM attr not found!!");

  }

}
@@ -92,24 +112,51 @@ static void bta_create_mas_sdp_record(bluetooth_sdp_record* record, 


  p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_MAS_INSTANCE_ID);

  if (p_attr != NULL) {

    if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) == 1) {

      record->mas.mas_instance_id = p_attr->attr_value.v.u8;

    } else {

      LOG_ERROR("ATTR_ID_MAS_INSTANCE_ID attr type or len wrong!!");

    }

  } else {

      LOG_ERROR("ATTR_ID_MAS_INSTANCE_ID attr not found!!");

  }



  p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_SUPPORTED_MSG_TYPE);

  if (p_attr != NULL) {

    if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) == 1) {

      record->mas.supported_message_types = p_attr->attr_value.v.u8;

    } else {

      LOG_ERROR("ATTR_ID_SUPPORTED_MSG_TYPE attr type or len wrong!!");

    }

  } else {

      LOG_ERROR("ATTR_ID_SUPPORTED_MSG_TYPE attr not found!!");

  }



  p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_MAP_SUPPORTED_FEATURES);

  if (p_attr != NULL) {

    if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) == 4) {

      record->mas.supported_features = p_attr->attr_value.v.u32;

    } else {

      LOG_ERROR("ATTR_ID_MAP_SUPPORTED_FEATURES attr type or len wrong!!");

    }

  } else {

      LOG_ERROR("ATTR_ID_MAP_SUPPORTED_FEATURES attr not found!!");

  }



  p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_SERVICE_NAME);

  if (p_attr != NULL) {

    if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == TEXT_STR_DESC_TYPE) {

      record->mas.hdr.service_name_length =

          SDP_DISC_ATTR_LEN(p_attr->attr_len_type);

      record->mas.hdr.service_name = (char*)p_attr->attr_value.v.array;

    } else {

      LOG_ERROR("ATTR_ID_SERVICE_NAME attr type wrong!!");

    }

  } else {

      LOG_ERROR("ATTR_ID_SERVICE_NAME attr not found!!");

  }



  if (SDP_FindProfileVersionInRec(p_rec, UUID_SERVCLASS_MAP_PROFILE,
@@ -123,7 +170,14 @@ static void bta_create_mas_sdp_record(bluetooth_sdp_record* record, 


  p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_GOEP_L2CAP_PSM);

  if (p_attr != NULL) {

    if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) == 2) {

      record->mas.hdr.l2cap_psm = p_attr->attr_value.v.u16;

    } else {

      LOG_ERROR("ATTR_ID_GOEP_L2CAP_PSM attr type or len wrong!!");

    }

  } else {

      LOG_ERROR("ATTR_ID_GOEP_L2CAP_PSM attr not found!!");

  }

}
@@ -144,18 +198,39 @@ static void bta_create_pse_sdp_record(bluetooth_sdp_record* record, 


  p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_SUPPORTED_REPOSITORIES);

  if (p_attr != NULL) {

    if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) == 1) {

      record->pse.supported_repositories = p_attr->attr_value.v.u8;

    } else {

      LOG_ERROR("ATTR_ID_SUPPORTED_REPOSITORIES attr type or len wrong!!");

    }

  } else {

      LOG_ERROR("ATTR_ID_SUPPORTED_REPOSITORIES attr not found!!");

  }

  p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_PBAP_SUPPORTED_FEATURES);

  if (p_attr != NULL) {

    if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) == 4) {

      record->pse.supported_features = p_attr->attr_value.v.u32;

    } else {

      LOG_ERROR("ATTR_ID_PBAP_SUPPORTED_FEATURES attr type or len wrong!!");

    }

  } else {

      LOG_ERROR("ATTR_ID_PBAP_SUPPORTED_FEATURES attr not found!!");

  }



  p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_SERVICE_NAME);

  if (p_attr != NULL) {

    if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == TEXT_STR_DESC_TYPE) {

      record->pse.hdr.service_name_length =

          SDP_DISC_ATTR_LEN(p_attr->attr_len_type);

      // TODO: validate the lifetime of this value

      record->pse.hdr.service_name = (char*)p_attr->attr_value.v.array;

    } else {

      LOG_ERROR("ATTR_ID_SERVICE_NAME attr type NOT string!!");

    }

  } else {

      LOG_ERROR("ATTR_ID_SERVICE_NAME attr not found!!");

  }



  if (SDP_FindProfileVersionInRec(p_rec, UUID_SERVCLASS_PHONE_ACCESS,
@@ -169,7 +244,14 @@ static void bta_create_pse_sdp_record(bluetooth_sdp_record* record, 


  p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_GOEP_L2CAP_PSM);

  if (p_attr != NULL) {

    if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) == 2) {

      record->pse.hdr.l2cap_psm = p_attr->attr_value.v.u16;

    } else {

      LOG_ERROR("ATTR_ID_GOEP_L2CAP_PSM attr type or len wrong!!");

    }

  } else {

      LOG_ERROR("ATTR_ID_GOEP_L2CAP_PSM attr not found!!");

  }

}
@@ -189,9 +271,15 @@ static void bta_create_ops_sdp_record(bluetooth_sdp_record* record, 


  p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_SERVICE_NAME);

  if (p_attr != NULL) {

    if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == TEXT_STR_DESC_TYPE) {

      record->ops.hdr.service_name_length =

          SDP_DISC_ATTR_LEN(p_attr->attr_len_type);

      record->ops.hdr.service_name = (char*)p_attr->attr_value.v.array;

    } else {

      LOG_ERROR("ATTR_ID_SERVICE_NAME attr type NOT string!!");

    }

  } else {

      LOG_ERROR("ATTR_ID_SERVICE_NAME attr not found!!");

  }



  if (SDP_FindProfileVersionInRec(p_rec, UUID_SERVCLASS_OBEX_OBJECT_PUSH,
@@ -205,8 +293,16 @@ static void bta_create_ops_sdp_record(bluetooth_sdp_record* record, 


  p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_GOEP_L2CAP_PSM);

  if (p_attr != NULL) {

    if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) == 2) {

      record->ops.hdr.l2cap_psm = p_attr->attr_value.v.u16;

    } else {

      LOG_ERROR("ATTR_ID_GOEP_L2CAP_PSM attr type or len wrong!!");

    }

  } else {

      LOG_ERROR("ATTR_ID_GOEP_L2CAP_PSM attr not found!!");

  }



  p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_SUPPORTED_FORMATS_LIST);

  if (p_attr != NULL) {

    /* Safety check - each entry should itself be a sequence */
@@ -273,9 +369,15 @@ static void bta_create_sap_sdp_record(bluetooth_sdp_record* record, 


  p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_SERVICE_NAME);

  if (p_attr != NULL) {

    if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == TEXT_STR_DESC_TYPE) {

      record->sap.hdr.service_name_length =

          SDP_DISC_ATTR_LEN(p_attr->attr_len_type);

      record->sap.hdr.service_name = (char*)p_attr->attr_value.v.array;

    } else {

      LOG_ERROR("ATTR_ID_SERVICE_NAME attr type NOT string!!");

    }

  } else {

      LOG_ERROR("ATTR_ID_SERVICE_NAME attr not found!!");

  }



  if (SDP_FindProfileVersionInRec(p_rec, UUID_SERVCLASS_SAP, &pversion)) {
@@ -303,43 +405,80 @@ static void bta_create_dip_sdp_record(bluetooth_sdp_record* record, 


  p_attr =

      SDP_FindAttributeInRec(p_rec, ATTR_ID_SPECIFICATION_ID);

  if (p_attr != nullptr)

  if (p_attr != nullptr) {

    if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) == 2) {

      record->dip.spec_id = p_attr->attr_value.v.u16;

  else

    } else {

      LOG_ERROR("ATTR_ID_SPECIFICATION_ID attr type or len wrong!!");

    }

  } else {

    APPL_TRACE_ERROR("%s() ATTR_ID_SPECIFICATION_ID not found", __func__);

  }



  p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_VENDOR_ID);

  if (p_attr != nullptr)

  if (p_attr != nullptr) {

    if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) == 2) {

      record->dip.vendor = p_attr->attr_value.v.u16;

  else

    } else {

      LOG_ERROR("ATTR_ID_VENDOR_ID attr type or len wrong!!");

    }

  } else {

    APPL_TRACE_ERROR("%s() ATTR_ID_VENDOR_ID not found", __func__);

  }



  p_attr =

      SDP_FindAttributeInRec(p_rec, ATTR_ID_VENDOR_ID_SOURCE);

  if (p_attr != nullptr)

  if (p_attr != nullptr) {

    if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) == 2) {

      record->dip.vendor_id_source = p_attr->attr_value.v.u16;

  else

    } else {

      LOG_ERROR("ATTR_ID_VENDOR_ID_SOURCE attr type or len wrong!!");

    }

  } else {

    APPL_TRACE_ERROR("%s() ATTR_ID_VENDOR_ID_SOURCE not found", __func__);

  }



  p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_PRODUCT_ID);

  if (p_attr != nullptr)

  if (p_attr != nullptr) {

    if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) == 2) {

      record->dip.product = p_attr->attr_value.v.u16;

  else

    } else {

      LOG_ERROR("ATTR_ID_PRODUCT_ID attr type or len wrong!!");

    }

  } else {

    APPL_TRACE_ERROR("%s() ATTR_ID_PRODUCT_ID not found", __func__);

  }



  p_attr =

      SDP_FindAttributeInRec(p_rec, ATTR_ID_PRODUCT_VERSION);

  if (p_attr != nullptr)



  if (p_attr != nullptr) {

    if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) == 2) {

      record->dip.version = p_attr->attr_value.v.u16;

  else

    } else {

      LOG_ERROR("ATTR_ID_PRODUCT_VERSION attr type or len wrong!!");

    }

  } else {

    APPL_TRACE_ERROR("%s() ATTR_ID_PRODUCT_VERSION not found", __func__);

  }



  p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_PRIMARY_RECORD);

  if (p_attr != nullptr)

  if (p_attr != nullptr) {

    if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == BOOLEAN_DESC_TYPE &&

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) == 1) {

      record->dip.primary_record = !(!p_attr->attr_value.v.u8);

  else

    } else {

      LOG_ERROR("ATTR_ID_PRIMARY_RECORD attr type or len wrong!!");

    }

  } else {

    APPL_TRACE_ERROR("%s() ATTR_ID_PRIMARY_RECORD not found", __func__);

  }

}



static void bta_create_raw_sdp_record(bluetooth_sdp_record* record,

                                      tSDP_DISC_REC* p_rec) {
@@ -356,9 +495,15 @@ static void bta_create_raw_sdp_record(bluetooth_sdp_record* record, 
  /* Try to extract a service name */

  p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_SERVICE_NAME);

  if (p_attr != NULL) {

    if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == TEXT_STR_DESC_TYPE) {

      record->pse.hdr.service_name_length =

          SDP_DISC_ATTR_LEN(p_attr->attr_len_type);

      record->pse.hdr.service_name = (char*)p_attr->attr_value.v.array;

    } else {

      LOG_ERROR("ATTR_ID_SERVICE_NAME attr type NOT string!!");

    }

  } else {

      LOG_ERROR("ATTR_ID_SERVICE_NAME attr not found!!");

  }



  /* Try to extract an RFCOMM channel */

system/bta/test/bta_dip_test.cc

+1 −1
Original line number Diff line number Diff line
@@ -92,7 +92,7 @@ class BtaDipTest : public ::testing::Test { 


    g_attr_vendor_product_primary_record.p_next_attr = &g_attr_vendor_product_primary_record;

    g_attr_vendor_product_primary_record.attr_id = ATTR_ID_PRIMARY_RECORD;

    g_attr_vendor_product_primary_record.attr_len_type = (BOOLEAN_DESC_TYPE<<12);

    g_attr_vendor_product_primary_record.attr_len_type = (BOOLEAN_DESC_TYPE<<12)|1;

    g_attr_vendor_product_primary_record.attr_value.v.u8 = 1;



    g_rec.p_first_attr = &g_attr_service_class_id_list;