From: Adam Seaton <aseaton@google.com>
Date: Fri, 22 Nov 2019 19:29:29 +0000 (+0000)
Subject: Revert "Fix potential OOB write in btm_read_remote_ext_features_complete"
X-Git-Url: http://git.osdn.net/view?a=commitdiff_plain;h=3e143758ffae55bfc8cf6c5e3871343c9973c3e7;p=android-x86%2Fsystem-bt.git

Revert "Fix potential OOB write in btm_read_remote_ext_features_complete"

This reverts commit 0d7723d147012c3141d259cce24745eb446ff1b1.

Reason for revert: reverting due to functional regressions in Auto.

Bug: 144205318
Change-Id: I96ec04beeb8eb4cb307f45c3c2a02d267c00c8fc
---

diff --git a/stack/btm/btm_acl.cc b/stack/btm/btm_acl.cc
index 5282be6f1..8df6acb81 100644
--- a/stack/btm/btm_acl.cc
+++ b/stack/btm/btm_acl.cc
@@ -47,7 +47,6 @@
 #include "device/include/interop.h"
 #include "hcidefs.h"
 #include "hcimsgs.h"
-#include "log/log.h"
 #include "l2c_int.h"
 #include "osi/include/osi.h"
 
@@ -1063,7 +1062,7 @@ void btm_read_remote_features_complete(uint8_t* p) {
  * Returns          void
  *
  ******************************************************************************/
-void btm_read_remote_ext_features_complete(uint8_t* p, uint8_t evt_len) {
+void btm_read_remote_ext_features_complete(uint8_t* p) {
   tACL_CONN* p_acl_cb;
   uint8_t page_num, max_page;
   uint16_t handle;
@@ -1071,14 +1070,6 @@ void btm_read_remote_ext_features_complete(uint8_t* p, uint8_t evt_len) {
 
   BTM_TRACE_DEBUG("btm_read_remote_ext_features_complete");
 
-  if (evt_len < HCI_EXT_FEATURES_SUCCESS_EVT_LEN) {
-    android_errorWriteLog(0x534e4554, "141552859");
-    BTM_TRACE_ERROR(
-        "btm_read_remote_ext_features_complete evt length too short. length=%d",
-        evt_len);
-    return;
-  }
-
   ++p;
   STREAM_TO_UINT16(handle, p);
   STREAM_TO_UINT8(page_num, p);
@@ -1098,13 +1089,6 @@ void btm_read_remote_ext_features_complete(uint8_t* p, uint8_t evt_len) {
     return;
   }
 
-  if (page_num > max_page) {
-    android_errorWriteLog(0x534e4554, "141552859");
-    BTM_TRACE_ERROR("btm_read_remote_ext_features_complete num_page=%d invalid",
-                    page_num);
-    return;
-  }
-
   p_acl_cb = &btm_cb.acl_db[acl_idx];
 
   /* Copy the received features page */
diff --git a/stack/btm/btm_int.h b/stack/btm/btm_int.h
index 76b05ef93..e6e0dffdc 100644
--- a/stack/btm/btm_int.h
+++ b/stack/btm/btm_int.h
@@ -117,7 +117,7 @@ extern uint16_t btm_get_acl_disc_reason_code(void);
 extern tBTM_STATUS btm_remove_acl(const RawAddress& bd_addr,
                                   tBT_TRANSPORT transport);
 extern void btm_read_remote_features_complete(uint8_t* p);
-extern void btm_read_remote_ext_features_complete(uint8_t* p, uint8_t evt_len);
+extern void btm_read_remote_ext_features_complete(uint8_t* p);
 extern void btm_read_remote_ext_features_failed(uint8_t status,
                                                 uint16_t handle);
 extern void btm_read_remote_version_complete(uint8_t* p);
diff --git a/stack/btu/btu_hcif.cc b/stack/btu/btu_hcif.cc
index 15227cb1b..9518d397b 100644
--- a/stack/btu/btu_hcif.cc
+++ b/stack/btu/btu_hcif.cc
@@ -70,8 +70,7 @@ static void btu_hcif_authentication_comp_evt(uint8_t* p);
 static void btu_hcif_rmt_name_request_comp_evt(uint8_t* p, uint16_t evt_len);
 static void btu_hcif_encryption_change_evt(uint8_t* p);
 static void btu_hcif_read_rmt_features_comp_evt(uint8_t* p);
-static void btu_hcif_read_rmt_ext_features_comp_evt(uint8_t* p,
-                                                    uint8_t evt_len);
+static void btu_hcif_read_rmt_ext_features_comp_evt(uint8_t* p);
 static void btu_hcif_read_rmt_version_comp_evt(uint8_t* p);
 static void btu_hcif_qos_setup_comp_evt(uint8_t* p);
 static void btu_hcif_command_complete_evt(BT_HDR* response, void* context);
@@ -195,7 +194,7 @@ void btu_hcif_process_event(UNUSED_ATTR uint8_t controller_id, BT_HDR* p_msg) {
       btu_hcif_read_rmt_features_comp_evt(p);
       break;
     case HCI_READ_RMT_EXT_FEATURES_COMP_EVT:
-      btu_hcif_read_rmt_ext_features_comp_evt(p, hci_evt_len);
+      btu_hcif_read_rmt_ext_features_comp_evt(p);
       break;
     case HCI_READ_RMT_VERSION_COMP_EVT:
       btu_hcif_read_rmt_version_comp_evt(p);
@@ -792,8 +791,7 @@ static void btu_hcif_read_rmt_features_comp_evt(uint8_t* p) {
  * Returns          void
  *
  ******************************************************************************/
-static void btu_hcif_read_rmt_ext_features_comp_evt(uint8_t* p,
-                                                    uint8_t evt_len) {
+static void btu_hcif_read_rmt_ext_features_comp_evt(uint8_t* p) {
   uint8_t* p_cur = p;
   uint8_t status;
   uint16_t handle;
@@ -801,7 +799,7 @@ static void btu_hcif_read_rmt_ext_features_comp_evt(uint8_t* p,
   STREAM_TO_UINT8(status, p_cur);
 
   if (status == HCI_SUCCESS)
-    btm_read_remote_ext_features_complete(p, evt_len);
+    btm_read_remote_ext_features_complete(p);
   else {
     STREAM_TO_UINT16(handle, p_cur);
     btm_read_remote_ext_features_failed(status, handle);
diff --git a/stack/include/hcidefs.h b/stack/include/hcidefs.h
index e40e55dd7..c015b979d 100644
--- a/stack/include/hcidefs.h
+++ b/stack/include/hcidefs.h
@@ -1296,8 +1296,6 @@ typedef struct {
 
 #define HCI_FEATURE_BYTES_PER_PAGE 8
 
-#define HCI_EXT_FEATURES_SUCCESS_EVT_LEN 13
-
 #define HCI_FEATURES_KNOWN(x) \
   (((x)[0] | (x)[1] | (x)[2] | (x)[3] | (x)[4] | (x)[5] | (x)[6] | (x)[7]) != 0)