Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e82a472f authored by Cheney Ni's avatar Cheney Ni Committed by Hansong Zhang
Browse files

Checks the SMP length to fix OOB read 

Bug: 111937065
Test: manual
Change-Id: I330880a6e1671d0117845430db4076dfe1aba688
Merged-In: I330880a6e1671d0117845430db4076dfe1aba688
parent e20ce635

system/stack/smp/smp_act.cc

+19 −1
Original line number Original line Diff line number Diff line
@@ -916,6 +916,15 @@ void smp_proc_enc_info(tSMP_CB* p_cb, tSMP_INT_DATA* p_data) { 
  uint8_t* p = p_data->p_data;

  uint8_t* p = p_data->p_data;





  SMP_TRACE_DEBUG("%s", __func__);

  SMP_TRACE_DEBUG("%s", __func__);



  if (smp_command_has_invalid_parameters(p_cb)) {

    tSMP_INT_DATA smp_int_data;

    smp_int_data.status = SMP_INVALID_PARAMETERS;

    android_errorWriteLog(0x534e4554, "111937065");

    smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &smp_int_data);

    return;

  }



  STREAM_TO_ARRAY(p_cb->ltk, p, BT_OCTET16_LEN);

  STREAM_TO_ARRAY(p_cb->ltk, p, BT_OCTET16_LEN);





  smp_key_distribution(p_cb, NULL);

  smp_key_distribution(p_cb, NULL);
@@ -948,13 +957,22 @@ void smp_proc_master_id(tSMP_CB* p_cb, tSMP_INT_DATA* p_data) { 
}

}





/*******************************************************************************

/*******************************************************************************

 * Function     smp_proc_enc_info

 * Function     smp_proc_id_info

 * Description  process identity information from peer device

 * Description  process identity information from peer device

 ******************************************************************************/

 ******************************************************************************/

void smp_proc_id_info(tSMP_CB* p_cb, tSMP_INT_DATA* p_data) {

void smp_proc_id_info(tSMP_CB* p_cb, tSMP_INT_DATA* p_data) {

  uint8_t* p = p_data->p_data;

  uint8_t* p = p_data->p_data;





  SMP_TRACE_DEBUG("%s", __func__);

  SMP_TRACE_DEBUG("%s", __func__);



  if (smp_command_has_invalid_parameters(p_cb)) {

    tSMP_INT_DATA smp_int_data;

    smp_int_data.status = SMP_INVALID_PARAMETERS;

    android_errorWriteLog(0x534e4554, "111937065");

    smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &smp_int_data);

    return;

  }



  STREAM_TO_ARRAY(p_cb->tk, p, BT_OCTET16_LEN); /* reuse TK for IRK */

  STREAM_TO_ARRAY(p_cb->tk, p, BT_OCTET16_LEN); /* reuse TK for IRK */

  smp_key_distribution_by_transport(p_cb, NULL);

  smp_key_distribution_by_transport(p_cb, NULL);

}

}