PAN: Fix Use-after-free in bta_pan_data_buf_ind_cback

Patch from b/67078939

Test: build
Bug: 67110692
Change-Id: I63b857d031c55d3a0754e4101e330843eb422b2a
Merged-In: I63b857d031c55d3a0754e4101e330843eb422b2a

diff --git a/bta/pan/bta_pan_act.c b/bta/pan/bta_pan_act.c
index b63acd1..4601799 100644 (file)
--- a/bta/pan/bta_pan_act.c
+++ b/bta/pan/bta_pan_act.c
@@ -206,6 +206,12 @@ static void bta_pan_data_buf_ind_cback(UINT16 handle, BD_ADDR src, BD_ADDR dst,
     BT_HDR * p_event;
     BT_HDR *p_new_buf;
 
+    p_scb = bta_pan_scb_by_handle(handle);
+    if (p_scb == NULL)
+    {
+        return;
+    }
+
     if ( sizeof(tBTA_PAN_DATA_PARAMS) > p_buf->offset )
     {
         if (sizeof(BT_HDR) + sizeof(tBTA_PAN_DATA_PARAMS) + p_buf->len >
@@ -213,7 +219,6 @@ static void bta_pan_data_buf_ind_cback(UINT16 handle, BD_ADDR src, BD_ADDR dst,
             android_errorWriteLog(0x534e4554, "63146237");
             APPL_TRACE_ERROR("%s: received buffer length too large: %d", __func__,
                              p_buf->len);
-            GKI_freebuf(p_buf);
             return;
         }
 
@@ -222,7 +227,6 @@ static void bta_pan_data_buf_ind_cback(UINT16 handle, BD_ADDR src, BD_ADDR dst,
         if(!p_new_buf)
         {
             APPL_TRACE_WARNING("Cannot get a PAN GKI buffer");
-            GKI_freebuf( p_buf );
             return;
         }
         else
@@ -230,7 +234,6 @@ static void bta_pan_data_buf_ind_cback(UINT16 handle, BD_ADDR src, BD_ADDR dst,
             memcpy( (UINT8 *)(p_new_buf+1)+sizeof(tBTA_PAN_DATA_PARAMS), (UINT8 *)(p_buf+1)+p_buf->offset, p_buf->len );
             p_new_buf->len    = p_buf->len;
             p_new_buf->offset = sizeof(tBTA_PAN_DATA_PARAMS);
-            GKI_freebuf( p_buf );
         }
     }
     else
@@ -244,14 +247,6 @@ static void bta_pan_data_buf_ind_cback(UINT16 handle, BD_ADDR src, BD_ADDR dst,
     ((tBTA_PAN_DATA_PARAMS *)p_new_buf)->ext = ext;
     ((tBTA_PAN_DATA_PARAMS *)p_new_buf)->forward = forward;
 
-
-    if((p_scb = bta_pan_scb_by_handle(handle)) == NULL)
-    {
-
-        GKI_freebuf( p_new_buf );
-        return;
-    }
-
     GKI_enqueue(&p_scb->data_queue, p_new_buf);
     if ((p_event = (BT_HDR *) GKI_getbuf(sizeof(BT_HDR))) != NULL)
     {

diff --git a/stack/bnep/bnep_main.c b/stack/bnep/bnep_main.c
index a20e1cf..34a6a0c 100644 (file)
--- a/stack/bnep/bnep_main.c
+++ b/stack/bnep/bnep_main.c
@@ -651,6 +651,7 @@ static void bnep_data_ind (UINT16 l2cap_cid, BT_HDR *p_buf)
     if (bnep_cb.p_data_buf_cb)
     {
         (*bnep_cb.p_data_buf_cb)(p_bcb->handle, p_src_addr, p_dst_addr, protocol, p_buf, fw_ext_present);
+        GKI_freebuf (p_buf);
     }
     else if (bnep_cb.p_data_ind_cb)
     {