Merge "Fix OOB caused by invalid SMP packet length"

diff --cc stack/smp/smp_act.cc
index cb0280c,f1afdc1..0ea6ae8
--- 1/stack/smp/smp_act.cc
--- 2/stack/smp/smp_act.cc
+++ b/stack/smp/smp_act.cc
@@@ -982,14 -992,23 +998,23 @@@ void smp_proc_id_info(tSMP_CB* p_cb, tS
  /** process identity address from peer device */
  void smp_proc_id_addr(tSMP_CB* p_cb, tSMP_INT_DATA* p_data) {
    uint8_t* p = p_data->p_data;
 -  tBTM_LE_PID_KEYS pid_key;
 +  tBTM_LE_KEY_VALUE pid_key;
  
    SMP_TRACE_DEBUG("%s", __func__);
+ 
+   if (smp_command_has_invalid_parameters(p_cb)) {
+     tSMP_INT_DATA smp_int_data;
+     smp_int_data.status = SMP_INVALID_PARAMETERS;
+     android_errorWriteLog(0x534e4554, "111214770");
+     smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &smp_int_data);
+     return;
+   }
+ 
    smp_update_key_mask(p_cb, SMP_SEC_KEY_TYPE_ID, true);
  
 -  STREAM_TO_UINT8(pid_key.identity_addr_type, p);
 -  STREAM_TO_BDADDR(pid_key.identity_addr, p);
 -  pid_key.irk = p_cb->tk;
 +  STREAM_TO_UINT8(pid_key.pid_key.identity_addr_type, p);
 +  STREAM_TO_BDADDR(pid_key.pid_key.identity_addr, p);
 +  pid_key.pid_key.irk = p_cb->tk;
  
    /* to use as BD_ADDR for lk derived from ltk */
    p_cb->id_addr_rcvd = true;
@@@ -1005,9 -1025,18 +1030,18 @@@
  
  /* process security information from peer device */
  void smp_proc_srk_info(tSMP_CB* p_cb, tSMP_INT_DATA* p_data) {
 -  tBTM_LE_PCSRK_KEYS le_key;
 +  tBTM_LE_KEY_VALUE le_key;
  
    SMP_TRACE_DEBUG("%s", __func__);
+ 
+   if (smp_command_has_invalid_parameters(p_cb)) {
+     tSMP_INT_DATA smp_int_data;
+     smp_int_data.status = SMP_INVALID_PARAMETERS;
+     android_errorWriteLog(0x534e4554, "111214470");
+     smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &smp_int_data);
+     return;
+   }
+ 
    smp_update_key_mask(p_cb, SMP_SEC_KEY_TYPE_CSRK, true);
  
    /* save CSRK to security record */

diff --cc stack/smp/smp_utils.cc
Simple merge