OSDN Git Service
Rahul Sabnis [Mon, 24 Aug 2020 23:36:36 +0000 (16:36 -0700)]
Send a response to an smp security request depending on the callback event
Tag: #feature
Bug:
157038281
Test: Manual
Merged-In: Iadeb25a43b46f615b55a0dfb6e7723e5d1204351
Change-Id: Iadeb25a43b46f615b55a0dfb6e7723e5d1204351
Rahul Sabnis [Wed, 5 Aug 2020 21:35:45 +0000 (21:35 +0000)]
[automerger skipped] Merge "Check whether local device is an ATV device to determine whether to show the consent dialog for BLE pairing in JUSTWORKS and ENCRYPTION_ONLY mode" into oc-dev am:
b2adda8177 am:
00fd683aec -s ours
am skip reason: Change-Id I6d06f5996da71e5a1407e544b0023d82924aa56f with SHA-1
0b4c1014f7 is in history
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/bt/+/
12309020
Change-Id: I64045645e5b0c45d25f239f52070f796e8162077
Rahul Sabnis [Wed, 5 Aug 2020 21:18:10 +0000 (21:18 +0000)]
Merge "Check whether local device is an ATV device to determine whether to show the consent dialog for BLE pairing in JUSTWORKS and ENCRYPTION_ONLY mode" into oc-dev am:
b2adda8177
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/bt/+/
12309020
Change-Id: I3cc71adac1897fb29ce5fb4012ed8b1567f1e614
Rahul Sabnis [Wed, 5 Aug 2020 20:56:23 +0000 (20:56 +0000)]
Merge "Check whether local device is an ATV device to determine whether to show the consent dialog for BLE pairing in JUSTWORKS and ENCRYPTION_ONLY mode" into oc-dev
Rahul Sabnis [Wed, 5 Aug 2020 20:51:45 +0000 (20:51 +0000)]
Merge "Check whether local device is an ATV device to determine whether to show the consent dialog for BLE pairing in JUSTWORKS and ENCRYPTION_ONLY mode" into oc-mr1-dev
weichinweng [Wed, 5 Aug 2020 12:13:40 +0000 (12:13 +0000)]
[automerger skipped] Fix possible OOB when receive gatt read type response data am:
342cb328b6 am:
6d86ead0e3 -s ours
am skip reason: Change-Id I1bd8713eecebc2bc3d919402b035987e06a2d4d3 with SHA-1
0eb7a763df is in history
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/bt/+/
12263265
Change-Id: I0e10ba38b8aa463e7524ca0da1c2aa8ce5c86b5b
weichinweng [Wed, 5 Aug 2020 11:59:47 +0000 (11:59 +0000)]
Fix possible OOB when receive gatt read type response data am:
342cb328b6
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/bt/+/
12263265
Change-Id: I064b5c88b2734129a9f1811f372713b01938ad9c
weichinweng [Tue, 28 Jul 2020 08:56:33 +0000 (16:56 +0800)]
Fix possible OOB when receive gatt read type response data
Bug:
158833854
Bug:
158778659
Test: manual
Tag: #security
Change-Id: I1bd8713eecebc2bc3d919402b035987e06a2d4d3
Merged-In: I1bd8713eecebc2bc3d919402b035987e06a2d4d3
Rahul Sabnis [Sat, 1 Aug 2020 02:44:27 +0000 (19:44 -0700)]
Check whether local device is an ATV device to determine whether to show
the consent dialog for BLE pairing in JUSTWORKS and ENCRYPTION_ONLY mode
Tag: #feature
Bug:
157038281
Test: Manual
Merged-In: I6d06f5996da71e5a1407e544b0023d82924aa56f
Change-Id: I6d06f5996da71e5a1407e544b0023d82924aa56f
Rahul Sabnis [Sat, 1 Aug 2020 02:44:27 +0000 (19:44 -0700)]
Check whether local device is an ATV device to determine whether to show
the consent dialog for BLE pairing in JUSTWORKS and ENCRYPTION_ONLY mode
Tag: #feature
Bug:
157038281
Test: Manual
Merged-In: I6d06f5996da71e5a1407e544b0023d82924aa56f
Change-Id: I6d06f5996da71e5a1407e544b0023d82924aa56f
weichinweng [Tue, 28 Jul 2020 08:56:33 +0000 (16:56 +0800)]
Fix possible OOB when receive gatt read type response data
Bug:
158833854
Bug:
158778659
Test: manual
Tag: #security
Change-Id: I1bd8713eecebc2bc3d919402b035987e06a2d4d3
Rahul Sabnis [Fri, 31 Jul 2020 00:51:00 +0000 (00:51 +0000)]
[automerger skipped] Shows a consent dialog on the local device when pairing a bluetooth low am:
57ffe1ba12 am:
70e77e9a2f -s ours
am skip reason: Change-Id I7de396230beb84bd0fa2b0cea346523b6824472a with SHA-1
b5c0bfc132 is in history
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/bt/+/
12040226
Change-Id: I5ad01f31ae5ad09d350a04ff3414ae516ad0077d
Rahul Sabnis [Fri, 31 Jul 2020 00:27:46 +0000 (00:27 +0000)]
Shows a consent dialog on the local device when pairing a bluetooth low am:
57ffe1ba12
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/bt/+/
12040226
Change-Id: I591af4f49890b67d9d110747984e1061aeaa9a57
Rahul Sabnis [Fri, 26 Jun 2020 17:27:07 +0000 (10:27 -0700)]
Shows a consent dialog on the local device when pairing a bluetooth low
energy device if the local device has a display.
Tag: #security
Bug:
157038281
Test: Manual
Merged-In: I7de396230beb84bd0fa2b0cea346523b6824472a
Change-Id: I7de396230beb84bd0fa2b0cea346523b6824472a
Rahul Sabnis [Fri, 26 Jun 2020 17:27:07 +0000 (10:27 -0700)]
Shows a consent dialog on the local device when pairing a bluetooth low
energy device if the local device has a display.
Tag: #security
Bug:
157038281
Test: Manual
Merged-In: I7de396230beb84bd0fa2b0cea346523b6824472a
Change-Id: I7de396230beb84bd0fa2b0cea346523b6824472a
Joseph Pirozzo [Fri, 26 Jun 2020 13:13:54 +0000 (13:13 +0000)]
Merge "Enable bitpool sanity checks" into oc-dev am:
15ccbf59de am:
b7bd79e254
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/bt/+/
11593936
Change-Id: I1f53339a2b08ec342d65fe45f6a69965b87edf4a
Joseph Pirozzo [Fri, 26 Jun 2020 13:01:21 +0000 (13:01 +0000)]
Merge "Enable bitpool sanity checks" into oc-dev am:
15ccbf59de
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/bt/+/
11593936
Change-Id: I53a4ce34dba71b7715f791a03b6128458f8bc7e8
Joseph Pirozzo [Fri, 26 Jun 2020 12:40:58 +0000 (12:40 +0000)]
Merge "Enable bitpool sanity checks" into oc-dev
Myles Watson [Thu, 25 Jun 2020 21:28:30 +0000 (21:28 +0000)]
[automerger skipped] DO NOT MERGE: Remove pairing on incoming bond request am:
85b5df1d0d am:
ab50a6b284 -s ours
am skip reason: Change-Id I048b7b142e3fe2096cf1a9aa2931c175fa52cd45 with SHA-1
e29c52cfda is in history
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/bt/+/
11934228
Change-Id: I01231f49767b1f5e54f43bf119e410a147198033
Myles Watson [Thu, 25 Jun 2020 21:15:23 +0000 (21:15 +0000)]
DO NOT MERGE: Remove pairing on incoming bond request am:
85b5df1d0d
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/bt/+/
11934228
Change-Id: Icf0c4b744a56a06669fea1effd45c898063a4631
Myles Watson [Thu, 18 Jun 2020 21:35:53 +0000 (14:35 -0700)]
DO NOT MERGE: Remove pairing on incoming bond request
Bug:
150156492
Tag: #security
Test: Bond two devices, forget from one device and reconnect
Change-Id: I048b7b142e3fe2096cf1a9aa2931c175fa52cd45
(cherry picked from commit
13f409ad3a2423b06af7a7f1a9b06fb06c8820a7)
Merged-In: I048b7b142e3fe2096cf1a9aa2931c175fa52cd45
Myles Watson [Thu, 18 Jun 2020 21:35:53 +0000 (14:35 -0700)]
DO NOT MERGE: Remove pairing on incoming bond request
Bug:
150156492
Tag: #security
Test: Bond two devices, forget from one device and reconnect
Change-Id: I048b7b142e3fe2096cf1a9aa2931c175fa52cd45
(cherry picked from commit
13f409ad3a2423b06af7a7f1a9b06fb06c8820a7)
Merged-In: I048b7b142e3fe2096cf1a9aa2931c175fa52cd45
Joseph Pirozzo [Mon, 25 May 2020 17:36:26 +0000 (10:36 -0700)]
Enable bitpool sanity checks
Enable bitpool sanity checks to run all the time, not just in debug
mode.
Tag: #security
Test: sbcdecoder_fuzzer
Bug:
146398979
Change-Id: Iff58305cd18de35e37290f0c09fba01ee14e787a
Jakub Pawlowski [Tue, 7 Apr 2020 23:09:11 +0000 (23:09 +0000)]
Fix potential stack overflow caused by integer overflow am:
1570b62c88 am:
5b4bf745e9
Change-Id: I91417fff40a89042993a9fcbfaa6b7f45c162d89
Jakub Pawlowski [Tue, 7 Apr 2020 22:51:21 +0000 (22:51 +0000)]
Fix potential stack overflow caused by integer overflow am:
1570b62c88
Change-Id: Iaf75d5b63297d50e3115422f15fa8511133ef45a
Jakub Pawlowski [Fri, 20 Mar 2020 14:24:00 +0000 (15:24 +0100)]
Fix potential stack overflow caused by integer overflow
Bug:
151155194
Merged-In: I0655b0b62301f78cd8705cc7b0e4fc11522f00ca
Change-Id: I0655b0b62301f78cd8705cc7b0e4fc11522f00ca
Automerger Merge Worker [Tue, 10 Mar 2020 23:58:30 +0000 (23:58 +0000)]
[automerger skipped] GattServcer: Check invalid offset am:
30a2860ed1 am:
2865a273f2 -s ours
am skip reason: Change-Id I0396380f431cdb7f91c78db6de9043ea0f373dfe with SHA-1
c14c1fb864 is in history
Change-Id: Iba77996d7a5acdbee2865868d506634620ccf793
Automerger Merge Worker [Tue, 10 Mar 2020 23:42:03 +0000 (23:42 +0000)]
GattServcer: Check invalid offset am:
30a2860ed1
Change-Id: I1d3aae196fb82155b88e2377e96670797f228f8a
Hansong Zhang [Thu, 13 Feb 2020 19:40:44 +0000 (11:40 -0800)]
GattServcer: Check invalid offset
Test: manual
Bug:
143231677
Merged-In: I0396380f431cdb7f91c78db6de9043ea0f373dfe
Merged-In: I0ca22e7c60292d61c758120c1cd67f6e6edd8ae8
Change-Id: I0ca22e7c60292d61c758120c1cd67f6e6edd8ae8
Hansong Zhang [Thu, 13 Feb 2020 19:40:44 +0000 (11:40 -0800)]
GattServcer: Check invalid offset
Test: manual
Bug:
143231677
Change-Id: I0396380f431cdb7f91c78db6de9043ea0f373dfe
Merged-In: I97e2c3ae15fccc482d07d8d621c455cc74900cfd
Merged-In: I0ca22e7c60292d61c758120c1cd67f6e6edd8ae8
TreeHugger Robot [Wed, 4 Dec 2019 08:29:41 +0000 (08:29 +0000)]
Merge "Fix potential OOB write in btm_read_remote_ext_features_complete" into oc-mr1-dev
Automerger Merge Worker [Wed, 4 Dec 2019 08:22:12 +0000 (08:22 +0000)]
Merge "Fix potential OOB write in btm_read_remote_ext_features_complete" into oc-dev am:
2039ca38e9 am:
5b85308108
Change-Id: I8c6f23a3cc7cfdb08242cbaa68ea62830ea49ccb
Automerger Merge Worker [Wed, 4 Dec 2019 08:13:37 +0000 (08:13 +0000)]
Merge "Fix potential OOB write in btm_read_remote_ext_features_complete" into oc-dev am:
2039ca38e9
Change-Id: I0767ba267fc51a926930288752a1a079414d5a76
TreeHugger Robot [Wed, 4 Dec 2019 08:04:13 +0000 (08:04 +0000)]
Merge "Fix potential OOB write in btm_read_remote_ext_features_complete" into oc-dev
Automerger Merge Worker [Tue, 3 Dec 2019 23:29:41 +0000 (23:29 +0000)]
Merge "SDP: add return after SDP disconnection" into oc-dev am:
765abc5cb6 am:
1f3bc32195
Change-Id: I08a3792c2110c102e1a61051ff74bfa8ef8735c8
Automerger Merge Worker [Tue, 3 Dec 2019 23:21:52 +0000 (23:21 +0000)]
Merge "SDP: add return after SDP disconnection" into oc-dev am:
765abc5cb6
Change-Id: I4adccd7acc83181359c798527f6231a2b29e4429
TreeHugger Robot [Tue, 3 Dec 2019 23:03:51 +0000 (23:03 +0000)]
Merge "SDP: add return after SDP disconnection" into oc-dev
Automerger Merge Worker [Tue, 3 Dec 2019 00:47:12 +0000 (00:47 +0000)]
Merge "GAP: Correct the continuous pkt length in l2cap" into oc-dev am:
2a8a9b22f2 am:
5d8fde3e01
Change-Id: I95231c695e0ec4a413c3cce64b3ea16936cc1bff
Automerger Merge Worker [Tue, 3 Dec 2019 00:40:09 +0000 (00:40 +0000)]
Merge "GAP: Correct the continuous pkt length in l2cap" into oc-dev am:
2a8a9b22f2
Change-Id: I9ed3a6586a87f199cef8b90d8c8c7d6bbb862823
TreeHugger Robot [Tue, 3 Dec 2019 00:33:29 +0000 (00:33 +0000)]
Merge "GAP: Correct the continuous pkt length in l2cap" into oc-dev
Ted Wang [Tue, 26 Nov 2019 03:46:38 +0000 (11:46 +0800)]
Fix potential OOB write in btm_read_remote_ext_features_complete
Add event length check to avoid hci event sent from controller not
correct.
Add page number check to avoid page number is bigger than
HCI_EXT_FEATURES_PAGE_MAX.
Bug:
141552859
Bug:
144205318
Test: inject function
Merged-In: Iaca4db4ee9bf27362f62aba0da088727e98955d1
Change-Id: Iaca4db4ee9bf27362f62aba0da088727e98955d1
Ted Wang [Tue, 26 Nov 2019 03:46:38 +0000 (11:46 +0800)]
Fix potential OOB write in btm_read_remote_ext_features_complete
Add event length check to avoid hci event sent from controller not
correct.
Add page number check to avoid page number is bigger than
HCI_EXT_FEATURES_PAGE_MAX.
Bug:
141552859
Bug:
144205318
Test: inject function
Merged-In: Iaca4db4ee9bf27362f62aba0da088727e98955d1
Change-Id: Iaca4db4ee9bf27362f62aba0da088727e98955d1
Ted Wang [Tue, 26 Nov 2019 03:33:50 +0000 (03:33 +0000)]
Merge "Revert "Fix potential OOB write in btm_read_remote_ext_features_complete"" into oc-mr1-dev
Automerger Merge Worker [Tue, 26 Nov 2019 02:55:04 +0000 (02:55 +0000)]
Merge "Revert "Fix potential OOB write in btm_read_remote_ext_features_complete"" into oc-dev am:
aa754ed3ec am:
53afb387a4
Change-Id: I22fb89a33d6265470d4dc82a19d3ff66ce1ad9fa
Automerger Merge Worker [Tue, 26 Nov 2019 02:45:55 +0000 (02:45 +0000)]
Merge "Revert "Fix potential OOB write in btm_read_remote_ext_features_complete"" into oc-dev am:
aa754ed3ec
Change-Id: I2cc0a9befe3c2b0412d53bad6b7790e61119cae2
Ted Wang [Tue, 26 Nov 2019 02:37:56 +0000 (02:37 +0000)]
Merge "Revert "Fix potential OOB write in btm_read_remote_ext_features_complete"" into oc-dev
Zongheng Wang [Tue, 12 Nov 2019 20:59:44 +0000 (12:59 -0800)]
SDP: add return after SDP disconnection
A return is needed after sdp_disconnect(). It is the logic
expected and it prevents the use of p_ccb after it's freed.
Bug:
144177780
Bug:
117105007
Test: manual test
Change-Id: I7a64382b36adca37a8ff0c7e361d89ecdc8f3b55
(cherry picked from commit
30efc8c90a846460359a489e17e1461c725958b3)
Adam Seaton [Fri, 22 Nov 2019 19:29:29 +0000 (19:29 +0000)]
Revert "Fix potential OOB write in btm_read_remote_ext_features_complete"
This reverts commit
0d7723d147012c3141d259cce24745eb446ff1b1.
Reason for revert: reverting due to functional regressions in Auto.
Bug:
144205318
Change-Id: I96ec04beeb8eb4cb307f45c3c2a02d267c00c8fc
Adam Seaton [Fri, 22 Nov 2019 19:29:14 +0000 (19:29 +0000)]
Revert "Fix potential OOB write in btm_read_remote_ext_features_complete"
This reverts commit
33a71f2955f1254d2f96fd4a4d16d44463a21423.
Reason for revert: reverting due to functional regressions in Auto.
Bug:
144205318
Change-Id: I6e1d62f370fc910e91c0919dcb3f37fa2f3c7bf5
Venkata Jagadeesh Garaga [Thu, 18 Apr 2019 11:43:49 +0000 (17:13 +0530)]
GAP: Correct the continuous pkt length in l2cap
L2cap continuous pkt length wrongly calculated in
reassembly logic when remote sends more data
than expected.
Wrong pkt length leading to memory corruption
Hence the Correct the continuous pkt length in
l2cap reassembly logic.
Bug:
135239489
Bug:
143894715
CRs-Fixed:
2434229
Test: make and internal testing
Change-Id: I758d9e31465b99e436b9b1841320000f08186c97
Merged-In: I758d9e31465b99e436b9b1841320000f08186c97
(cherry picked from commit
337bd4579453bd6bf98ff519de3ac1019cd30d28)
Ted Wang [Wed, 6 Nov 2019 21:13:44 +0000 (13:13 -0800)]
[automerger skipped] Merge "Fix potential OOB write in btm_read_remote_ext_features_complete" into oc-dev am:
981e2483c6
am:
4b700057ae -s ours
am skip reason: change_id I3bd7349f382aa0e42123bbd835dcb60b77af099a with SHA1
0d7723d147 is in history
Change-Id: I4e3cea1e80f91d5a7789fa5305a1fafea6690a70
Ted Wang [Wed, 6 Nov 2019 21:08:00 +0000 (13:08 -0800)]
Merge "Fix potential OOB write in btm_read_remote_ext_features_complete" into oc-dev
am:
981e2483c6
Change-Id: Iba00aec2298d8b6522555a56ba02b3dba5b7de3b
TreeHugger Robot [Wed, 6 Nov 2019 17:55:06 +0000 (17:55 +0000)]
Merge "Fix potential OOB write in btm_read_remote_ext_features_complete" into oc-dev
TreeHugger Robot [Wed, 6 Nov 2019 17:48:42 +0000 (17:48 +0000)]
Merge "Fix potential OOB write in btm_read_remote_ext_features_complete" into oc-mr1-dev
Ted Wang [Fri, 4 Oct 2019 10:39:02 +0000 (18:39 +0800)]
Fix potential OOB write in btm_read_remote_ext_features_complete
Add event length check to avoid hci event sent from controller not
correct.
Add page number check to avoid page number is bigger than max page
number.
Bug:
141552859
Test: inject function
Merged-In: I3bd7349f382aa0e42123bbd835dcb60b77af099a
Change-Id: I3bd7349f382aa0e42123bbd835dcb60b77af099a
Ted Wang [Fri, 4 Oct 2019 10:39:02 +0000 (18:39 +0800)]
Fix potential OOB write in btm_read_remote_ext_features_complete
Add event length check to avoid hci event sent from controller not
correct.
Add page number check to avoid page number is bigger than max page
number.
Bug:
141552859
Test: inject function
Merged-In: I3bd7349f382aa0e42123bbd835dcb60b77af099a
Change-Id: I3bd7349f382aa0e42123bbd835dcb60b77af099a
Nick Desaulniers [Tue, 15 Oct 2019 21:31:31 +0000 (14:31 -0700)]
[system][bt] fix -Wdangling-gsl am:
20ed45d633
am:
2f0c176bad
Change-Id: I82b0d0a3b21111b8711d58609c3f70f4637bc74b
Nick Desaulniers [Tue, 15 Oct 2019 21:24:30 +0000 (14:24 -0700)]
[system][bt] fix -Wdangling-gsl
am:
20ed45d633
Change-Id: I9f59103dc40ae2154a2b2314d309ba0f7184376a
Nick Desaulniers [Thu, 10 Oct 2019 21:04:47 +0000 (14:04 -0700)]
[system][bt] fix -Wdangling-gsl
BtAddrString() returns a std::string. It's not safe to chain a call to
c_str() as otherwise the returned std::string is a temporary, and the
expression evaluates to an immediately dangling pointer.
Bug:
139945549
Bug:
142558228
Test: mm
Change-Id: I30972458abcc563b24ee0d80b289c3efd6c3e04d
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
Martin Brabham [Wed, 2 Oct 2019 01:13:16 +0000 (18:13 -0700)]
JustWorks: Auto-accept only incoming temporary pairing. am:
10e15ee461
am:
103ba67ee2
Change-Id: I89a7a2650b3c4814a28c13a287722485d0b6eba7
Martin Brabham [Wed, 2 Oct 2019 01:06:15 +0000 (18:06 -0700)]
JustWorks: Auto-accept only incoming temporary pairing.
am:
10e15ee461
Change-Id: I392280bb44e2ab665baeab5ef5f1e6b9323fe463
Martin Brabham [Thu, 20 Jun 2019 15:59:24 +0000 (08:59 -0700)]
JustWorks: Auto-accept only incoming temporary pairing.
Bug:
110433804
Bug:
134461862
Test: Manual; atest net_test_bluetooth
Change-Id: I4e3f39bc08e9d9493734a21ea29d76e43aeb50c8
Merged-In: I4e3f39bc08e9d9493734a21ea29d76e43aeb50c8
Rahul Sabnis [Sat, 28 Sep 2019 01:03:54 +0000 (18:03 -0700)]
[automerger skipped] Merge "Use memcpy instead of casting to convert device_class to int" into oc-dev am:
ca7cd4593a
am:
92b5515436 -s ours
am skip reason: change_id Iee71ce35576e438317841d41a81fda6a87e1984a with SHA1
ecf8f751b0 is in history
Change-Id: I9fdc5544ebca6f8849ae522890eb5774b5cc914f
Rahul Sabnis [Sat, 28 Sep 2019 00:57:56 +0000 (17:57 -0700)]
Merge "Use memcpy instead of casting to convert device_class to int" into oc-dev
am:
ca7cd4593a
Change-Id: I2b44586f43a2249034a286338c2ba68b78339cb7
TreeHugger Robot [Sat, 28 Sep 2019 00:40:38 +0000 (00:40 +0000)]
Merge "Use memcpy instead of casting to convert device_class to int" into oc-dev
TreeHugger Robot [Sat, 28 Sep 2019 00:40:01 +0000 (00:40 +0000)]
Merge "Use memcpy instead of casting to convert device_class to int" into oc-mr1-dev
Zongheng Wang [Fri, 27 Sep 2019 21:31:23 +0000 (14:31 -0700)]
SDP: Disconnect when there is a bad length am:
7f555a1a9b
am:
325d1539ba
Change-Id: I21d1ab45bfe4f1e13a8e168abaafaafb1ccb1198
Zongheng Wang [Fri, 27 Sep 2019 21:30:53 +0000 (14:30 -0700)]
SDP: disconnect if sdp_copy_raw_data fails am:
41939a2b5a
am:
e6bda7c73b
Change-Id: Ia3f4fe31ed2f8ea056a1dd0d3b07b8af6799dc19
Zongheng Wang [Fri, 27 Sep 2019 21:24:46 +0000 (14:24 -0700)]
SDP: Disconnect when there is a bad length
am:
7f555a1a9b
Change-Id: Ia4da75e08758cda98a79bdd1f37be2480e36c71d
Zongheng Wang [Fri, 27 Sep 2019 21:24:22 +0000 (14:24 -0700)]
SDP: disconnect if sdp_copy_raw_data fails
am:
41939a2b5a
Change-Id: Icf97e5e7008909461c92ec761c8ced647002754f
Zongheng Wang [Wed, 21 Aug 2019 00:56:04 +0000 (17:56 -0700)]
SDP: Disconnect when there is a bad length
Handle the case when SDP_RAW_DATA_INCLUDED is FALSE.
Related to: I9f0df8b2de28970e7d69b737ce5d363785183bf3
Bug:
137239831
Bug:
117105007
Test: manual test
Change-Id: I354494565005f2ca9093486546fc54c145066413
Merged-In: I354494565005f2ca9093486546fc54c145066413
(cherry picked from commit
e45fe0a8ec678c73c57967b69c2fd485eef92927)
Ted Wang [Fri, 20 Sep 2019 01:10:45 +0000 (18:10 -0700)]
Fix potential OOB read in sdpu_get_len_from_type
am:
fa800d23fa
Change-Id: I06b19e7e195f7d0f80b8371b58a003809bd1f9c5
Ted Wang [Mon, 29 Apr 2019 02:11:04 +0000 (10:11 +0800)]
Fix potential OOB read in sdpu_get_len_from_type
Add boundary check in sdpu_get_len_from_type to prevent potential OOB read.
(This commit was skipped from oc-dr1-dev down, so the Merged-In tag is
from a later CL to avoid a conflict)
Bug:
117105007
Test: Manul
Change-Id: I1bb50e840a977df1c0403f3cce2d73dd1a73aa62
Merged-In: I9f0df8b2de28970e7d69b737ce5d363785183bf3
(cherry picked from commit
1243f8da338dadfe2a3c281a08297b431402d41c)
(cherry picked from commit
4d8e1d63e1a2116c47702d38d858f5a742e8292f)
Myles Watson [Wed, 18 Sep 2019 18:50:21 +0000 (11:50 -0700)]
[automerger skipped] DO NOT MERGE: SDP: Check p_end in save_attr_seq and add_attr
am:
4291c84baa -s ours
am skip reason: change_id Ib642f79ed22b65ede5ff786cb1e163d172480f11 with SHA1
d4f012bc80 is in history
Change-Id: I73d7f92b5dc4ab723c721edbc53131e8be6c3d79
Myles Watson [Thu, 25 Oct 2018 00:05:12 +0000 (17:05 -0700)]
DO NOT MERGE: SDP: Check p_end in save_attr_seq and add_attr
(This CL is missed between oc-dev and oc-mr1-dev)
Bug:
115900043
Test: Sanity pairing and SDP PTS
Change-Id: Ib642f79ed22b65ede5ff786cb1e163d172480f11
Merged-In: Ib642f79ed22b65ede5ff786cb1e163d172480f11
(cherry picked from commit
d4f012bc80bc68be1cab967958d4cf7e9c1ee442)
Rahul Sabnis [Fri, 30 Aug 2019 01:23:37 +0000 (18:23 -0700)]
Use memcpy instead of casting to convert device_class to int
Bug:
140152619
Test: atest net_test_btcoreclear
Change-Id: Iee71ce35576e438317841d41a81fda6a87e1984a
Merged-In: Iee71ce35576e438317841d41a81fda6a87e1984a
(cherry picked from commit
ec75f1efb6b9be4933225a4b724e7a3ef5e3d70b)
Rahul Sabnis [Fri, 30 Aug 2019 01:23:37 +0000 (18:23 -0700)]
Use memcpy instead of casting to convert device_class to int
Bug:
140152619
Test: atest net_test_btcoreclear
Change-Id: Iee71ce35576e438317841d41a81fda6a87e1984a
Merged-In: Iee71ce35576e438317841d41a81fda6a87e1984a
(cherry picked from commit
ec75f1efb6b9be4933225a4b724e7a3ef5e3d70b)
Zongheng Wang [Mon, 5 Aug 2019 19:45:35 +0000 (12:45 -0700)]
SDP: disconnect if sdp_copy_raw_data fails
Our partners met with the problem with sdp_copy_raw_data updated in
CVE-2019-2116. When peer device responds with a wrong size,
sdp_copy_raw_data will not complete and won't trigger
disconnection. This CL enables the disconnection when a wrong size is
received.
Bug:
137239831
Bug:
117105007
Test: manual test
Change-Id: I9f0df8b2de28970e7d69b737ce5d363785183bf3
Merged-In: I9f0df8b2de28970e7d69b737ce5d363785183bf3
(cherry picked from commit
bc9df3451dad17c1ab1002fdbc85d60e57d4f0af)
Ugo Yu [Wed, 11 Sep 2019 17:01:13 +0000 (10:01 -0700)]
[automerger skipped] resolve merge conflicts of
098e2972201b454de0f95a72636ecd9009dc32de to oc-dr1-dev
am:
9bc574c618 -s ours
am skip reason: change_id I18b4a1d8e2cdcd6dd4a300f1dc9e6d3892a3baff with SHA1
a65f859b17 is in history
Change-Id: Iffd5b655457623e328f3cce1a5894d8a611cd417
Ugo Yu [Wed, 11 Sep 2019 05:52:45 +0000 (13:52 +0800)]
resolve merge conflicts of
098e2972201b454de0f95a72636ecd9009dc32de to oc-dr1-dev
Bug:
79703832
Test: I solemnly swear I tested this conflict resolution.
Change-Id: Id582a274929f10d65e22d71f61de4b8953fed18e
Merged-In: I18b4a1d8e2cdcd6dd4a300f1dc9e6d3892a3baff
Ugo Yu [Thu, 11 Jul 2019 12:12:42 +0000 (20:12 +0800)]
DO NOT MERGE Store BLE keys using the address from the ble_auth_cmpl_evt
Reading the peer address from btif_dm_ble_auth_cmpl_evt, instead
of using the value from the pairing control block in
btif_dm_save_ble_bonding_keys, ensures that BLE keys are stored with
the correct address.
Bug:
133234174
Bug:
79703832
Test: 1. Initiate crosskey pairing from BLE
2. Check whether BLE keys are stored correctly
Change-Id: I18b4a1d8e2cdcd6dd4a300f1dc9e6d3892a3baff
Merged-In: I18b4a1d8e2cdcd6dd4a300f1dc9e6d3892a3baff
(cherry picked from commit
0d95651e8b22b1012f1ee103e4a0b8665a0c17d4)
Ugo Yu [Thu, 11 Jul 2019 12:12:42 +0000 (20:12 +0800)]
DO NOT MERGE Store BLE keys using the address from the ble_auth_cmpl_evt
Reading the peer address from btif_dm_ble_auth_cmpl_evt, instead
of using the value from the pairing control block in
btif_dm_save_ble_bonding_keys, ensures that BLE keys are stored with
the correct address.
Bug:
133234174
Bug:
79703832
Test: 1. Initiate crosskey pairing from BLE
2. Check whether BLE keys are stored correctly
Change-Id: I18b4a1d8e2cdcd6dd4a300f1dc9e6d3892a3baff
(cherry picked from commit
0d95651e8b22b1012f1ee103e4a0b8665a0c17d4)
Jakub Pawlowski [Fri, 7 Jun 2019 10:12:23 +0000 (03:12 -0700)]
[automerger skipped] Merge changes from topic "am-
e3f94184-0df3-403b-b2dc-
4ebd50beee32" into oc-dev am:
38535adcd0 -s ours
am:
28a8e8b848 -s ours
am skip reason: change_id Iab0fd9f357d18a6b048b971d0393fbb47fd4d793 with SHA1
461f0b4739 is in history
Change-Id: I128d6b1fbeccea202ddaaa73e4a1c9032afdfda1
Jakub Pawlowski [Fri, 7 Jun 2019 10:12:08 +0000 (03:12 -0700)]
[automerger skipped] DO NOT MERGE Fix for Bluetooth connection being dropped after HCI Read Encryption Key Size am:
461f0b4739 -s ours
am:
35f2cb15f1 -s ours
am skip reason: change_id Iab0fd9f357d18a6b048b971d0393fbb47fd4d793 with SHA1
bdac7b911f is in history
Change-Id: Idd9e3a1ffa28ca0de51f37b043c452b0cde9fcfe
Jakub Pawlowski [Fri, 7 Jun 2019 10:08:32 +0000 (03:08 -0700)]
[automerger skipped] Merge changes from topic "am-
e3f94184-0df3-403b-b2dc-
4ebd50beee32" into oc-dev
am:
38535adcd0 -s ours
am skip reason: change_id Iab0fd9f357d18a6b048b971d0393fbb47fd4d793 with SHA1
461f0b4739 is in history
Change-Id: I14e6e0212fd40a7a74cc9f4672cd8ce611763761
Jakub Pawlowski [Fri, 7 Jun 2019 10:08:09 +0000 (03:08 -0700)]
[automerger skipped] DO NOT MERGE Fix for Bluetooth connection being dropped after HCI Read Encryption Key Size
am:
461f0b4739 -s ours
am skip reason: SHA1
461f0b4739 skipped by user jpawlowski
Change-Id: If029a012222cb9a45a593282524518f30f9f0dc6
Jakub Pawlowski [Thu, 6 Jun 2019 19:47:12 +0000 (19:47 +0000)]
Merge changes from topic "am-
e3f94184-0df3-403b-b2dc-
4ebd50beee32" into oc-dev
* changes:
[automerger] DO NOT MERGE Fix for Bluetooth connection being dropped after HCI Read Encryption Key Size am:
c5aa5feebf am:
0a76ef0245 am:
20649305ba am:
20f1cf2b81 skipped:
cb880ad379
[automerger] DO NOT MERGE Fix for Bluetooth connection being dropped after HCI Read Encryption Key Size am:
c5aa5feebf am:
0a76ef0245 am:
20649305ba am:
20f1cf2b81
[automerger] DO NOT MERGE Fix for Bluetooth connection being dropped after HCI Read Encryption Key Size am:
c5aa5feebf am:
0a76ef0245 am:
20649305ba
[automerger] DO NOT MERGE Fix for Bluetooth connection being dropped after HCI Read Encryption Key Size am:
c5aa5feebf am:
0a76ef0245
[automerger] DO NOT MERGE Fix for Bluetooth connection being dropped after HCI Read Encryption Key Size am:
c5aa5feebf
DO NOT MERGE Fix for Bluetooth connection being dropped after HCI Read Encryption Key Size
Android Build Merger (Role) [Thu, 6 Jun 2019 14:32:33 +0000 (14:32 +0000)]
[automerger] DO NOT MERGE Fix for Bluetooth connection being dropped after HCI Read Encryption Key Size am:
c5aa5feebf am:
0a76ef0245 am:
20649305ba am:
20f1cf2b81 skipped:
cb880ad379
Change-Id: I0ce92d6832d71961c2774d523ccaff25aae6ee75
Android Build Merger (Role) [Thu, 6 Jun 2019 14:32:29 +0000 (14:32 +0000)]
[automerger] DO NOT MERGE Fix for Bluetooth connection being dropped after HCI Read Encryption Key Size am:
c5aa5feebf am:
0a76ef0245 am:
20649305ba am:
20f1cf2b81
Change-Id: I462281e1e328875bff50defc951aa436245740da
Android Build Merger (Role) [Thu, 6 Jun 2019 14:32:26 +0000 (14:32 +0000)]
[automerger] DO NOT MERGE Fix for Bluetooth connection being dropped after HCI Read Encryption Key Size am:
c5aa5feebf am:
0a76ef0245 am:
20649305ba
Change-Id: Idcdaee2b8091c775df14722a28b56589957833f2
Android Build Merger (Role) [Thu, 6 Jun 2019 14:32:23 +0000 (14:32 +0000)]
[automerger] DO NOT MERGE Fix for Bluetooth connection being dropped after HCI Read Encryption Key Size am:
c5aa5feebf am:
0a76ef0245
Change-Id: I570033782572166e69cd1edd65260c499473a661
Android Build Merger (Role) [Thu, 6 Jun 2019 14:32:19 +0000 (14:32 +0000)]
[automerger] DO NOT MERGE Fix for Bluetooth connection being dropped after HCI Read Encryption Key Size am:
c5aa5feebf
Change-Id: Id7ceb1b67894931e9c0ce188dff19177afd4a7ee
Jakub Pawlowski [Thu, 6 Jun 2019 11:54:55 +0000 (13:54 +0200)]
DO NOT MERGE Fix for Bluetooth connection being dropped after HCI Read Encryption Key Size
If remote device stop the encryption before we call "Read Encryption Key Size",
we might receive Insufficient Security, which means that link is no longer
encrypted.
In such cases we should stay connected, rather than disconnecting the
link.
Test: Connect to device that stop encryption right after encryption is
complete, i.e. to change roles.
Bug:
124301137
Bug:
132626699
Change-Id: Iab0fd9f357d18a6b048b971d0393fbb47fd4d793
Merged-In: Iab0fd9f357d18a6b048b971d0393fbb47fd4d793
Jakub Pawlowski [Thu, 6 Jun 2019 11:54:55 +0000 (13:54 +0200)]
DO NOT MERGE Fix for Bluetooth connection being dropped after HCI Read Encryption Key Size
If remote device stop the encryption before we call "Read Encryption Key Size",
we might receive Insufficient Security, which means that link is no longer
encrypted.
In such cases we should stay connected, rather than disconnecting the
link.
Test: Connect to device that stop encryption right after encryption is
complete, i.e. to change roles.
Bug:
124301137
Bug:
132626699
Change-Id: Iab0fd9f357d18a6b048b971d0393fbb47fd4d793
Merged-In: Iab0fd9f357d18a6b048b971d0393fbb47fd4d793
Jakub Pawlowski [Thu, 6 Jun 2019 11:54:55 +0000 (13:54 +0200)]
DO NOT MERGE Fix for Bluetooth connection being dropped after HCI Read Encryption Key Size
If remote device stop the encryption before we call "Read Encryption Key Size",
we might receive Insufficient Security, which means that link is no longer
encrypted.
In such cases we should stay connected, rather than disconnecting the
link.
Test: Connect to device that stop encryption right after encryption is
complete, i.e. to change roles.
Bug:
124301137
Bug:
132626699
Change-Id: Iab0fd9f357d18a6b048b971d0393fbb47fd4d793
Merged-In: Iab0fd9f357d18a6b048b971d0393fbb47fd4d793
Ugo Yu [Wed, 5 Jun 2019 03:51:54 +0000 (20:51 -0700)]
[automerger skipped] Merge "DO NOT MERGE Separate SDP procedure from bonding state (1/2)" into oc-dev am:
b751ea3a90
am:
2b3330a139 -s ours
am skip reason: change_id I8a98ba2178039e25c65fc701855066a8788312e6 with SHA1
9d5a28a536 is in history
Change-Id: I739288fe523814fce940eb2b33aa84d328af92c0
Ugo Yu [Wed, 5 Jun 2019 03:51:42 +0000 (20:51 -0700)]
[automerger skipped] DO NOT MERGE Separate SDP procedure from bonding state (1/2) am:
5240e71881
am:
5f8f0c8b74 -s ours
am skip reason: change_id I8a98ba2178039e25c65fc701855066a8788312e6 with SHA1
9d5a28a536 is in history
Change-Id: I03fe1c7c5a372fd126e9885a4412c2b63b138751
Ugo Yu [Wed, 5 Jun 2019 03:44:59 +0000 (20:44 -0700)]
Merge "DO NOT MERGE Separate SDP procedure from bonding state (1/2)" into oc-dev
am:
b751ea3a90
Change-Id: I4fd4b7d5d0328f40688fa2cd2321b95c12beb99e
Ugo Yu [Wed, 5 Jun 2019 03:44:47 +0000 (20:44 -0700)]
DO NOT MERGE Separate SDP procedure from bonding state (1/2)
am:
5240e71881
Change-Id: I12aa00ba24326d58ce73f15b6ddc82f22201945e
TreeHugger Robot [Wed, 5 Jun 2019 03:26:32 +0000 (03:26 +0000)]
Merge "DO NOT MERGE Separate SDP procedure from bonding state (1/2)" into oc-dev
OSDN Git Service
