OSDN Git Service
Hansong Zhang [Fri, 1 Feb 2019 23:33:09 +0000 (15:33 -0800)]
Merge "process_l2cap_cmd: Fix OOB" into oc-dev
am:
356edb4333
Change-Id: I0e1800587513bdb39e0b6eff7e46254470ab2def
TreeHugger Robot [Fri, 1 Feb 2019 23:18:22 +0000 (23:18 +0000)]
Merge "process_l2cap_cmd: Fix OOB" into oc-dev
Hansong Zhang [Wed, 30 Jan 2019 00:49:16 +0000 (16:49 -0800)]
Merge "btm_ble_multi_adv: Check data length in HCI interface" into oc-dev
am:
19460901d8
Change-Id: If4f3b40817ff57bdae4777ae330854a9119ae0b7
TreeHugger Robot [Wed, 30 Jan 2019 00:25:28 +0000 (00:25 +0000)]
Merge "btm_ble_multi_adv: Check data length in HCI interface" into oc-dev
Hansong Zhang [Mon, 14 Jan 2019 22:59:35 +0000 (14:59 -0800)]
process_l2cap_cmd: Fix OOB
Bug:
119870451
Test: POC
Change-Id: I2f5e7fedd9aed96c4ffc55af79fdac61c2e5b087
Merged-In: I5131bbf9cda6248fdbbc4bb91916b2fe3731246e
Hansong Zhang [Wed, 16 Jan 2019 20:33:26 +0000 (12:33 -0800)]
btm_ble_multi_adv: Check data length in HCI interface
For BleAdvertiserVscHciInterfaceImpl and
BleAdvertiserLegacyHciInterfaceImpl, the maximum size of scan response
and advertising packet data length should be BTM_BLE_AD_DATA_LEN (31).
Bug:
121145627
Test: POC
Change-Id: I7653a6c186b7313ef2b1547bca120b9d41c90140
Stanley Tng [Mon, 7 Jan 2019 22:40:43 +0000 (14:40 -0800)]
[automerger skipped] Merge "DO NOT MERGE A security fix to check buffer length in l2c_lcc_proc_pdu" into oc-dev
am:
3fd73e4ad2 -s ours
am skip reason: change_id I30b7a8af11d3a5f974cb39e06b0e3463bebc8e9a with SHA1
c1fcbd5508 is in history
Change-Id: Ie17711d48b90d8921cf26dc501cdfb776c7ef47e
Stanley Tng [Mon, 7 Jan 2019 22:40:22 +0000 (14:40 -0800)]
[automerger] DO NOT MERGE A security fix to check buffer length in l2c_lcc_proc_pdu am:
c1fcbd5508 am:
85b4574a31 am:
097ecf3d88 am:
2ebe3d52b0 skipped:
dff13d810c
am:
47dcb6a458
Change-Id: Ief422a38b0c559b912038c038edc48854357b3bf
TreeHugger Robot [Mon, 7 Jan 2019 22:33:36 +0000 (22:33 +0000)]
Merge "DO NOT MERGE A security fix to check buffer length in l2c_lcc_proc_pdu" into oc-dev
Stanley Tng [Tue, 11 Dec 2018 22:45:13 +0000 (14:45 -0800)]
DO NOT MERGE A security fix to check buffer length in l2c_lcc_proc_pdu
Add check to make sure that data buffer is big enough to read the 2
bytes for length.
Also, fix a regression from the previous CL that checks the buffer length
before doing a memcpy. The previous check is too strict causing valid
sized buffers to be rejected. The length check is incorrect and off by the header size.
Bug:
120665616
Test: Run the SL4A Test for LE CoC, BleCoCTest
Merged-In: I30b7a8af11d3a5f974cb39e06b0e3463bebc8e9a
Change-Id: I30b7a8af11d3a5f974cb39e06b0e3463bebc8e9a
(cherry picked from commit
fcb1994de1f6ee34b8dc6804a2b32e20bf138073)
(cherry picked from commit
1f1d8b97d80d25023c4c7b04d2aa18d367f4158d)
(cherry picked from commit
6b2739f309f7719086eb8201b3e1a35ba60035f4)
Android Build Merger (Role) [Sun, 6 Jan 2019 21:36:29 +0000 (21:36 +0000)]
[automerger] DO NOT MERGE A security fix to check buffer length in l2c_lcc_proc_pdu am:
c1fcbd5508 am:
85b4574a31 am:
097ecf3d88 am:
2ebe3d52b0 skipped:
dff13d810c
Change-Id: I92b4d78f5b6a53c863e7ec6d91b4cc32982258f8
Android Build Merger (Role) [Sun, 6 Jan 2019 21:36:28 +0000 (21:36 +0000)]
[automerger] DO NOT MERGE A security fix to check buffer length in l2c_lcc_proc_pdu am:
c1fcbd5508 am:
85b4574a31 am:
097ecf3d88 am:
2ebe3d52b0
Change-Id: I0cbec621cadfaaf9142d427b52a17cd9db3cd08a
Android Build Merger (Role) [Sun, 6 Jan 2019 21:36:27 +0000 (21:36 +0000)]
[automerger] DO NOT MERGE A security fix to check buffer length in l2c_lcc_proc_pdu am:
c1fcbd5508 am:
85b4574a31 am:
097ecf3d88
Change-Id: I9fd0733ff10442ca2050e440b954a9cb2f574c1a
Android Build Merger (Role) [Sun, 6 Jan 2019 21:36:26 +0000 (21:36 +0000)]
[automerger] DO NOT MERGE A security fix to check buffer length in l2c_lcc_proc_pdu am:
c1fcbd5508 am:
85b4574a31
Change-Id: I40ce009c5868fde902bc29a0af1b62c89f02f158
Android Build Merger (Role) [Sun, 6 Jan 2019 21:36:24 +0000 (21:36 +0000)]
[automerger] DO NOT MERGE A security fix to check buffer length in l2c_lcc_proc_pdu am:
c1fcbd5508
Change-Id: I5812786ed1ac013a273e300c1ddbe3fd26857543
Stanley Tng [Tue, 11 Dec 2018 22:45:13 +0000 (14:45 -0800)]
DO NOT MERGE A security fix to check buffer length in l2c_lcc_proc_pdu
Add check to make sure that data buffer is big enough to read the 2
bytes for length.
Also, fix a regression from the previous CL that checks the buffer length
before doing a memcpy. The previous check is too strict causing valid
sized buffers to be rejected. The length check is incorrect and off by the header size.
Bug:
120665616
Test: Run the SL4A Test for LE CoC, BleCoCTest
Merged-In: I30b7a8af11d3a5f974cb39e06b0e3463bebc8e9a
Change-Id: I30b7a8af11d3a5f974cb39e06b0e3463bebc8e9a
(cherry picked from commit
fcb1994de1f6ee34b8dc6804a2b32e20bf138073)
(cherry picked from commit
1f1d8b97d80d25023c4c7b04d2aa18d367f4158d)
(cherry picked from commit
6b2739f309f7719086eb8201b3e1a35ba60035f4)
Ugo Yu [Fri, 30 Nov 2018 21:13:52 +0000 (13:13 -0800)]
Add OOB check in avrc_pars_browse_rsp
am:
f44cbb20e7
Change-Id: Ieabff141ded21319a946fa0829bdb60cdedd8e9b
Ugo Yu [Tue, 13 Nov 2018 12:03:28 +0000 (20:03 +0800)]
Add OOB check in avrc_pars_browse_rsp
Bug:
111451066
Test: Manully
Change-Id: I068d218b8957bb8f053148d252a9119a8def28cc
Jakub Pawlowski [Thu, 29 Nov 2018 13:31:11 +0000 (05:31 -0800)]
[automerger skipped] [automerger] Fix buffer overflow in btif_dm_data_copy am:
d117975904 am:
12d8535d0f am:
98ced409a5 am:
c75667da96 skipped:
89e9bbb83c
am:
2f53d6ce3c -s ours
Change-Id: If82ef8a6331a62d932eeb3dffaee577ee7d7ea25
Android Build Merger (Role) [Thu, 29 Nov 2018 11:52:36 +0000 (11:52 +0000)]
[automerger] Fix buffer overflow in btif_dm_data_copy am:
d117975904 am:
12d8535d0f am:
98ced409a5 am:
c75667da96 skipped:
89e9bbb83c
Change-Id: Ia431ddd5ad1d6ee86bd6edd1057372b8dbf51d3b
Android Build Merger (Role) [Thu, 29 Nov 2018 11:51:42 +0000 (11:51 +0000)]
[automerger] Fix buffer overflow in btif_dm_data_copy am:
d117975904 am:
12d8535d0f am:
98ced409a5 am:
c75667da96
Change-Id: I0e5f1348f27f0d9981f99cc0897f9dcc9f443bf3
Android Build Merger (Role) [Thu, 29 Nov 2018 11:51:39 +0000 (11:51 +0000)]
[automerger] Fix buffer overflow in btif_dm_data_copy am:
d117975904 am:
12d8535d0f am:
98ced409a5
Change-Id: I258a6e883061d68b24b30e17e03f72d2000e5f3f
Android Build Merger (Role) [Thu, 29 Nov 2018 11:51:37 +0000 (11:51 +0000)]
[automerger] Fix buffer overflow in btif_dm_data_copy am:
d117975904 am:
12d8535d0f
Change-Id: I22ea297e564616790fd7e916747cdcea25d2b068
Android Build Merger (Role) [Thu, 29 Nov 2018 11:51:34 +0000 (11:51 +0000)]
[automerger] Fix buffer overflow in btif_dm_data_copy am:
d117975904
Change-Id: Icbd5b31039dbf3016575f9d6d69b216d76564c96
Jakub Pawlowski [Tue, 27 Nov 2018 16:59:57 +0000 (17:59 +0100)]
Fix buffer overflow in btif_dm_data_copy
When we use a union, we should always define variables as the union type,
not as one of the field subtypes. If the latter is cast to the union type,
buffer overflow can happen.
Bug:
110166268
Test: compilation
Change-Id: I473c03b099ad5a326e7a3739f65efd33cf4775bd
Merged-In: I473c03b099ad5a326e7a3739f65efd33cf4775bd
Jakub Pawlowski [Thu, 29 Nov 2018 09:33:56 +0000 (01:33 -0800)]
Fix buffer overflow in btif_dm_data_copy
am:
969b2df3a0
Change-Id: Icc0b739672cf0683edf9bfc5d8244b1ceb87a1b6
Jakub Pawlowski [Tue, 27 Nov 2018 17:22:22 +0000 (18:22 +0100)]
Fix buffer overflow in btif_dm_data_copy
When we use a union, we should always define variables as the union type,
not as one of the field subtypes. If the latter is cast to the union type,
buffer overflow can happen.
Bug:
110166268
Test: compilation
Change-Id: I473c03b099ad5a326e7a3739f65efd33cf4775bd
Merged-In: I473c03b099ad5a326e7a3739f65efd33cf4775bd
Jakub Pawlowski [Tue, 27 Nov 2018 21:14:37 +0000 (13:14 -0800)]
[automerger skipped] [automerger] Fix potential usage of freed memory in btif_hl_proc_sdp_query_cfm am:
78508d2c2c am:
a236f16071 am:
3f5af0aa65 am:
12557bb999 skipped:
2470706409
am:
d2dd0bacbc -s ours
Change-Id: If276bb160498a352e02bdb6231ac8fed8142aec4
Android Build Merger (Role) [Tue, 27 Nov 2018 20:09:16 +0000 (20:09 +0000)]
[automerger] Fix potential usage of freed memory in btif_hl_proc_sdp_query_cfm am:
78508d2c2c am:
a236f16071 am:
3f5af0aa65 am:
12557bb999 skipped:
2470706409
Change-Id: Id4bfbba911ecb95c728e1daba294fefc9d1de4ce
Android Build Merger (Role) [Tue, 27 Nov 2018 16:47:48 +0000 (16:47 +0000)]
[automerger] Fix potential usage of freed memory in btif_hl_proc_sdp_query_cfm am:
78508d2c2c am:
a236f16071 am:
3f5af0aa65 am:
12557bb999
Change-Id: I1ecbacc502b14733b0f4bd11b057763506b1fd95
Android Build Merger (Role) [Tue, 27 Nov 2018 16:47:45 +0000 (16:47 +0000)]
[automerger] Fix potential usage of freed memory in btif_hl_proc_sdp_query_cfm am:
78508d2c2c am:
a236f16071 am:
3f5af0aa65
Change-Id: I98ae5ab9e24acd447c0c72835067db0bc7430371
Android Build Merger (Role) [Tue, 27 Nov 2018 16:47:42 +0000 (16:47 +0000)]
[automerger] Fix potential usage of freed memory in btif_hl_proc_sdp_query_cfm am:
78508d2c2c am:
a236f16071
Change-Id: I8615cedf8b9192c46506c54934229089021fe101
Android Build Merger (Role) [Tue, 27 Nov 2018 16:47:40 +0000 (16:47 +0000)]
[automerger] Fix potential usage of freed memory in btif_hl_proc_sdp_query_cfm am:
78508d2c2c
Change-Id: If8da202c56ee7deeb7aba67f59b19ef28466f6ae
Jakub Pawlowski [Tue, 20 Nov 2018 21:31:31 +0000 (22:31 +0100)]
Fix potential usage of freed memory in btif_hl_proc_sdp_query_cfm
Bug:
116222069
Test: compilation
Change-Id: Iebe2c500dfc2806ca321fdcd170e20c680619d4d
Merged-In: Iebe2c500dfc2806ca321fdcd170e20c680619d4d
Jakub Pawlowski [Tue, 27 Nov 2018 16:19:03 +0000 (08:19 -0800)]
Fix potential usage of freed memory in btif_hl_proc_sdp_query_cfm
am:
889efd5b91
Change-Id: If3ae150367def015874bebb60c2fca763f01133f
Jakub Pawlowski [Tue, 20 Nov 2018 21:31:31 +0000 (22:31 +0100)]
Fix potential usage of freed memory in btif_hl_proc_sdp_query_cfm
Bug:
116222069
Test: compilation
Change-Id: Iebe2c500dfc2806ca321fdcd170e20c680619d4d
Cheney Ni [Tue, 13 Nov 2018 00:35:58 +0000 (16:35 -0800)]
Revert "Fix OOB in avrc_pars_browse_rsp"
am:
6d1c4974bf
Change-Id: I164343e6a08e851173a730fb06173fd6dca60f03
Cheney Ni [Thu, 8 Nov 2018 18:56:07 +0000 (18:56 +0000)]
Revert "Fix OOB in avrc_pars_browse_rsp"
This reverts commit
32a33dc12d4a9b21306510a98bcd039ca3be1dd3.
Reason for revert: regression issue found.
Change-Id: I48db0b0313477e1f3b6fe97cd4d540dfe16f3963
Bug:
111451066
Chienyuan [Mon, 5 Nov 2018 21:38:46 +0000 (13:38 -0800)]
Merge "DO NOT MERGE HFP: Check AT command buffer boundary during parsing" into oc-dev
am:
6bc3fa5698
Change-Id: Ib0f1f4d80313b20e2db2233b0766dfdf887f7bb3
TreeHugger Robot [Mon, 5 Nov 2018 21:32:27 +0000 (21:32 +0000)]
Merge "DO NOT MERGE HFP: Check AT command buffer boundary during parsing" into oc-dev
Myles Watson [Mon, 5 Nov 2018 19:22:43 +0000 (11:22 -0800)]
[automerger skipped] Merge "DO NOT MERGE: SDP: Check p_end in save_attr_seq and add_attr" into oc-dev
am:
f90160ea4f -s ours
Change-Id: Ibfd89fac51bc174eb75f144f623c59b8f290c655
TreeHugger Robot [Mon, 5 Nov 2018 19:06:20 +0000 (19:06 +0000)]
Merge "DO NOT MERGE: SDP: Check p_end in save_attr_seq and add_attr" into oc-dev
Chienyuan [Mon, 5 Nov 2018 18:24:35 +0000 (10:24 -0800)]
[automerger skipped] DO NOT MERGE HFP: Check AT command buffer boundary during parsing skipped:
163dec2ae1 skipped:
9805ed7a7a skipped:
f9606e1d89 skipped:
c96313fb2c skipped:
9c2fb57cee
am:
18515721e5 -s ours
Change-Id: I5b428c6b8ed1cd08d03a5f3c76f46a7211f2077d
Hansong Zhang [Mon, 5 Nov 2018 18:03:36 +0000 (18:03 +0000)]
Merge "DO NOT MERGE HFP: Check AT command buffer boundary during parsing" into nyc-dev
Android Build Merger (Role) [Mon, 5 Nov 2018 18:01:29 +0000 (18:01 +0000)]
[automerger skipped] DO NOT MERGE HFP: Check AT command buffer boundary during parsing skipped:
163dec2ae1 skipped:
9805ed7a7a skipped:
f9606e1d89 skipped:
c96313fb2c skipped:
9c2fb57cee
Change-Id: I9bb69caded703f74c79189f0cf78069e1fab9ca5
Android Build Merger (Role) [Mon, 5 Nov 2018 18:01:28 +0000 (18:01 +0000)]
[automerger skipped] DO NOT MERGE HFP: Check AT command buffer boundary during parsing skipped:
163dec2ae1 skipped:
9805ed7a7a skipped:
f9606e1d89 skipped:
c96313fb2c
Change-Id: I29b39b9cd2b0390289b525bf50ce4080b4a9557a
Android Build Merger (Role) [Mon, 5 Nov 2018 18:01:27 +0000 (18:01 +0000)]
[automerger skipped] DO NOT MERGE HFP: Check AT command buffer boundary during parsing skipped:
163dec2ae1 skipped:
9805ed7a7a skipped:
f9606e1d89
Change-Id: Iee0814f1ed5a5decc214abad4721a84825cd53b1
Android Build Merger (Role) [Mon, 5 Nov 2018 18:01:26 +0000 (18:01 +0000)]
[automerger skipped] DO NOT MERGE HFP: Check AT command buffer boundary during parsing skipped:
163dec2ae1 skipped:
9805ed7a7a
Change-Id: I5977408e04b4479c9aa2b5d16a03e18d7e9deced
Android Build Merger (Role) [Mon, 5 Nov 2018 18:01:25 +0000 (18:01 +0000)]
[automerger skipped] DO NOT MERGE HFP: Check AT command buffer boundary during parsing skipped:
163dec2ae1
Change-Id: I406dd66fa46d18b70d48faedf810d6a3ddbe3fbc
Myles Watson [Mon, 5 Nov 2018 17:33:38 +0000 (09:33 -0800)]
Merge "DO NOT MERGE: HH: Check parameter length in bta_hh_ctrl_dat_act" into oc-dev
am:
f6dc20ea52
Change-Id: Ia27e3b2a51ef75bc07b1ba5a8b5aa7064f4aadd6
Myles Watson [Mon, 5 Nov 2018 17:33:14 +0000 (09:33 -0800)]
Merge changes from topic "am-
154171ba-0805-48c6-88cf-
c592ee3cf37c" into oc-dev
am:
518c50aaa9
Change-Id: Ia8b2acfb4a82f90624459a3e49edbeae64d5481f
TreeHugger Robot [Mon, 5 Nov 2018 17:16:37 +0000 (17:16 +0000)]
Merge "DO NOT MERGE: HH: Check parameter length in bta_hh_ctrl_dat_act" into oc-dev
TreeHugger Robot [Mon, 5 Nov 2018 17:16:34 +0000 (17:16 +0000)]
Merge "DO NOT MERGE: HH: Check parameter length in bta_hh_ctrl_dat_act" into nyc-dev
TreeHugger Robot [Mon, 5 Nov 2018 17:16:34 +0000 (17:16 +0000)]
Merge changes from topic "am-
154171ba-0805-48c6-88cf-
c592ee3cf37c" into nyc-mr2-dev
* changes:
[automerger] DO NOT MERGE: HH: Check parameter length in bta_hh_ctrl_dat_act am:
a4a11e1981 am:
9172befdc8 am:
13e8d7ad1c am:
d474c386ef
[automerger] DO NOT MERGE: HH: Check parameter length in bta_hh_ctrl_dat_act am:
a4a11e1981 am:
9172befdc8 am:
13e8d7ad1c
[automerger] DO NOT MERGE: HH: Check parameter length in bta_hh_ctrl_dat_act am:
a4a11e1981 am:
9172befdc8
[automerger] DO NOT MERGE: HH: Check parameter length in bta_hh_ctrl_dat_act am:
a4a11e1981
DO NOT MERGE: HH: Check parameter length in bta_hh_ctrl_dat_act
TreeHugger Robot [Mon, 5 Nov 2018 17:16:34 +0000 (17:16 +0000)]
Merge changes from topic "am-
154171ba-0805-48c6-88cf-
c592ee3cf37c" into cw-f-dev
* changes:
[automerger] DO NOT MERGE: HH: Check parameter length in bta_hh_ctrl_dat_act am:
a4a11e1981 am:
9172befdc8 am:
13e8d7ad1c
[automerger] DO NOT MERGE: HH: Check parameter length in bta_hh_ctrl_dat_act am:
a4a11e1981 am:
9172befdc8
[automerger] DO NOT MERGE: HH: Check parameter length in bta_hh_ctrl_dat_act am:
a4a11e1981
DO NOT MERGE: HH: Check parameter length in bta_hh_ctrl_dat_act
TreeHugger Robot [Mon, 5 Nov 2018 17:16:34 +0000 (17:16 +0000)]
Merge changes from topic "am-
154171ba-0805-48c6-88cf-
c592ee3cf37c" into nyc-mr1-dev
* changes:
[automerger] DO NOT MERGE: HH: Check parameter length in bta_hh_ctrl_dat_act am:
a4a11e1981 am:
9172befdc8
[automerger] DO NOT MERGE: HH: Check parameter length in bta_hh_ctrl_dat_act am:
a4a11e1981
DO NOT MERGE: HH: Check parameter length in bta_hh_ctrl_dat_act
TreeHugger Robot [Mon, 5 Nov 2018 17:16:34 +0000 (17:16 +0000)]
Merge changes from topic "am-
154171ba-0805-48c6-88cf-
c592ee3cf37c" into nyc-dr1-dev
* changes:
[automerger] DO NOT MERGE: HH: Check parameter length in bta_hh_ctrl_dat_act am:
a4a11e1981
DO NOT MERGE: HH: Check parameter length in bta_hh_ctrl_dat_act
TreeHugger Robot [Mon, 5 Nov 2018 17:16:34 +0000 (17:16 +0000)]
Merge changes from topic "am-
154171ba-0805-48c6-88cf-
c592ee3cf37c" into oc-dev
* changes:
[automerger] DO NOT MERGE: HH: Check parameter length in bta_hh_ctrl_dat_act am:
a4a11e1981 am:
9172befdc8 am:
13e8d7ad1c am:
d474c386ef skipped:
0ea657053e
[automerger] DO NOT MERGE: HH: Check parameter length in bta_hh_ctrl_dat_act am:
a4a11e1981 am:
9172befdc8 am:
13e8d7ad1c am:
d474c386ef
[automerger] DO NOT MERGE: HH: Check parameter length in bta_hh_ctrl_dat_act am:
a4a11e1981 am:
9172befdc8 am:
13e8d7ad1c
[automerger] DO NOT MERGE: HH: Check parameter length in bta_hh_ctrl_dat_act am:
a4a11e1981 am:
9172befdc8
[automerger] DO NOT MERGE: HH: Check parameter length in bta_hh_ctrl_dat_act am:
a4a11e1981
DO NOT MERGE: HH: Check parameter length in bta_hh_ctrl_dat_act
Chienyuan [Sat, 3 Nov 2018 04:31:37 +0000 (21:31 -0700)]
Merge changes from topic "Check-AT-command-buffer-boundary-during-parsing" into oc-dev
am:
97ed603b62
Change-Id: I68020bb39483cf639ef295b657385a16c6680b90
Chienyuan [Thu, 11 Oct 2018 01:47:46 +0000 (09:47 +0800)]
DO NOT MERGE HFP: Check AT command buffer boundary during parsing
* add p_end parameter to tBTA_AG_AT_CMD_CBACK, bta_ag_at_hsp_cback
and bta_ag_at_hfp_cback to indicate effective data range of p_arg
* add checks for buffer copy overflow in bta_ag_at_hsp_cback and
bta_ag_at_hfp_cback
* add packet legnth checks with p_end in bta_ag_parse_cmer
* add packet length checks with p_end in bta_ag_parse_bac
Bug:
112860487
Test: manual
Change-Id: I6bbbc2ba29ad025c7d3ba023d8191af6a11c4aa9
Merged-In: I6bbbc2ba29ad025c7d3ba023d8191af6a11c4aa9
TreeHugger Robot [Sat, 3 Nov 2018 00:37:33 +0000 (00:37 +0000)]
Merge changes from topic "Check-AT-command-buffer-boundary-during-parsing" into nyc-mr2-dev
* changes:
[automerger] DO NOT MERGE HFP: Check AT command buffer boundary during parsing am:
aea10aec7f am:
289b3fa863
[automerger] DO NOT MERGE HFP: Check AT command buffer boundary during parsing am:
aea10aec7f
DO NOT MERGE HFP: Check AT command buffer boundary during parsing
TreeHugger Robot [Sat, 3 Nov 2018 00:37:33 +0000 (00:37 +0000)]
Merge changes from topic "Check-AT-command-buffer-boundary-during-parsing" into cw-f-dev
* changes:
[automerger] DO NOT MERGE HFP: Check AT command buffer boundary during parsing am:
aea10aec7f
DO NOT MERGE HFP: Check AT command buffer boundary during parsing
TreeHugger Robot [Sat, 3 Nov 2018 00:37:33 +0000 (00:37 +0000)]
Merge "DO NOT MERGE HFP: Check AT command buffer boundary during parsing" into nyc-mr1-dev
TreeHugger Robot [Sat, 3 Nov 2018 00:37:33 +0000 (00:37 +0000)]
Merge changes from topic "Check-AT-command-buffer-boundary-during-parsing" into oc-dev
* changes:
[automerger] DO NOT MERGE HFP: Check AT command buffer boundary during parsing am:
aea10aec7f am:
289b3fa863 skipped:
04ade0fdc0
[automerger] DO NOT MERGE HFP: Check AT command buffer boundary during parsing am:
aea10aec7f am:
289b3fa863
[automerger] DO NOT MERGE HFP: Check AT command buffer boundary during parsing am:
aea10aec7f
DO NOT MERGE HFP: Check AT command buffer boundary during parsing
Myles Watson [Thu, 25 Oct 2018 00:05:12 +0000 (17:05 -0700)]
DO NOT MERGE: SDP: Check p_end in save_attr_seq and add_attr
Bug:
115900043
Test: Sanity pairing and SDP PTS
Change-Id: Ib642f79ed22b65ede5ff786cb1e163d172480f11
Merged-In: Ib642f79ed22b65ede5ff786cb1e163d172480f11
Myles Watson [Fri, 2 Nov 2018 23:01:24 +0000 (16:01 -0700)]
Merge changes from topic "am-
3290ac2a-4a57-4151-aaf8-
9695d2ed6348" into oc-dev
am:
74749c1996
Change-Id: Ie0b18788113d43696ee9b0a35c8352bb4bf7c8a2
Myles Watson [Fri, 2 Nov 2018 22:59:55 +0000 (15:59 -0700)]
Merge "DO NOT MERGE: MCAP: Check response length in mca_ccb_hdl_rsp" into oc-dev
am:
7d38013232
Change-Id: I4e52d6cbaa27dc59f90d5c0f7ee63bdac5d40667
Myles Watson [Fri, 2 Nov 2018 22:59:31 +0000 (15:59 -0700)]
Merge changes from topic "am-
a8794701-2d32-4392-bf6f-
9d00a3751e39" into oc-dev
am:
6d6c82d9e0
Change-Id: I4b9f9f0d282b966b123a36d2bf22a95f5ad89577
TreeHugger Robot [Fri, 2 Nov 2018 22:47:59 +0000 (22:47 +0000)]
Merge "DO NOT MERGE: SDP: Check p_end in save_attr_seq and add_attr" into nyc-dev
TreeHugger Robot [Fri, 2 Nov 2018 22:47:59 +0000 (22:47 +0000)]
Merge changes from topic "am-
3290ac2a-4a57-4151-aaf8-
9695d2ed6348" into nyc-dr1-dev
* changes:
[automerger] DO NOT MERGE: SDP: Check p_end in save_attr_seq and add_attr am:
2091fe7501
DO NOT MERGE: SDP: Check p_end in save_attr_seq and add_attr
TreeHugger Robot [Fri, 2 Nov 2018 22:47:59 +0000 (22:47 +0000)]
Merge changes from topic "am-
3290ac2a-4a57-4151-aaf8-
9695d2ed6348" into nyc-mr2-dev
* changes:
[automerger] DO NOT MERGE: SDP: Check p_end in save_attr_seq and add_attr am:
2091fe7501 am:
4494b9be43 am:
07b95830b3 am:
e50ffa7119
[automerger] DO NOT MERGE: SDP: Check p_end in save_attr_seq and add_attr am:
2091fe7501 am:
4494b9be43 am:
07b95830b3
[automerger] DO NOT MERGE: SDP: Check p_end in save_attr_seq and add_attr am:
2091fe7501 am:
4494b9be43
[automerger] DO NOT MERGE: SDP: Check p_end in save_attr_seq and add_attr am:
2091fe7501
DO NOT MERGE: SDP: Check p_end in save_attr_seq and add_attr
TreeHugger Robot [Fri, 2 Nov 2018 22:47:59 +0000 (22:47 +0000)]
Merge changes from topic "am-
3290ac2a-4a57-4151-aaf8-
9695d2ed6348" into cw-f-dev
* changes:
[automerger] DO NOT MERGE: SDP: Check p_end in save_attr_seq and add_attr am:
2091fe7501 am:
4494b9be43 am:
07b95830b3
[automerger] DO NOT MERGE: SDP: Check p_end in save_attr_seq and add_attr am:
2091fe7501 am:
4494b9be43
[automerger] DO NOT MERGE: SDP: Check p_end in save_attr_seq and add_attr am:
2091fe7501
DO NOT MERGE: SDP: Check p_end in save_attr_seq and add_attr
TreeHugger Robot [Fri, 2 Nov 2018 22:47:59 +0000 (22:47 +0000)]
Merge changes from topic "am-
3290ac2a-4a57-4151-aaf8-
9695d2ed6348" into nyc-mr1-dev
* changes:
[automerger] DO NOT MERGE: SDP: Check p_end in save_attr_seq and add_attr am:
2091fe7501 am:
4494b9be43
[automerger] DO NOT MERGE: SDP: Check p_end in save_attr_seq and add_attr am:
2091fe7501
DO NOT MERGE: SDP: Check p_end in save_attr_seq and add_attr
TreeHugger Robot [Fri, 2 Nov 2018 22:47:59 +0000 (22:47 +0000)]
Merge changes from topic "am-
3290ac2a-4a57-4151-aaf8-
9695d2ed6348" into oc-dev
* changes:
[automerger] DO NOT MERGE: SDP: Check p_end in save_attr_seq and add_attr am:
2091fe7501 am:
4494b9be43 am:
07b95830b3 am:
e50ffa7119 skipped:
fc00aa02bf
[automerger] DO NOT MERGE: SDP: Check p_end in save_attr_seq and add_attr am:
2091fe7501 am:
4494b9be43 am:
07b95830b3 am:
e50ffa7119
[automerger] DO NOT MERGE: SDP: Check p_end in save_attr_seq and add_attr am:
2091fe7501 am:
4494b9be43 am:
07b95830b3
[automerger] DO NOT MERGE: SDP: Check p_end in save_attr_seq and add_attr am:
2091fe7501 am:
4494b9be43
[automerger] DO NOT MERGE: SDP: Check p_end in save_attr_seq and add_attr am:
2091fe7501
DO NOT MERGE: SDP: Check p_end in save_attr_seq and add_attr
TreeHugger Robot [Fri, 2 Nov 2018 22:44:07 +0000 (22:44 +0000)]
Merge "DO NOT MERGE: MCAP: Check response length in mca_ccb_hdl_rsp" into oc-dev
TreeHugger Robot [Fri, 2 Nov 2018 22:43:43 +0000 (22:43 +0000)]
Merge changes from topic "am-
a8794701-2d32-4392-bf6f-
9d00a3751e39" into oc-dev
* changes:
[automerger] DO NOT MERGE: MCAP: Check response length in mca_ccb_hdl_rsp am:
840f70ca1e am:
c1f3afedf3 am:
3f5160f5aa am:
0f2de3c3df skipped:
a3dbdeece2
[automerger] DO NOT MERGE: MCAP: Check response length in mca_ccb_hdl_rsp am:
840f70ca1e am:
c1f3afedf3 am:
3f5160f5aa am:
0f2de3c3df
[automerger] DO NOT MERGE: MCAP: Check response length in mca_ccb_hdl_rsp am:
840f70ca1e am:
c1f3afedf3 am:
3f5160f5aa
[automerger] DO NOT MERGE: MCAP: Check response length in mca_ccb_hdl_rsp am:
840f70ca1e am:
c1f3afedf3
[automerger] DO NOT MERGE: MCAP: Check response length in mca_ccb_hdl_rsp am:
840f70ca1e
DO NOT MERGE: MCAP: Check response length in mca_ccb_hdl_rsp
TreeHugger Robot [Fri, 2 Nov 2018 22:43:43 +0000 (22:43 +0000)]
Merge "DO NOT MERGE: MCAP: Check response length in mca_ccb_hdl_rsp" into nyc-dev
TreeHugger Robot [Fri, 2 Nov 2018 22:43:43 +0000 (22:43 +0000)]
Merge changes from topic "am-
a8794701-2d32-4392-bf6f-
9d00a3751e39" into nyc-dr1-dev
* changes:
[automerger] DO NOT MERGE: MCAP: Check response length in mca_ccb_hdl_rsp am:
840f70ca1e
DO NOT MERGE: MCAP: Check response length in mca_ccb_hdl_rsp
TreeHugger Robot [Fri, 2 Nov 2018 22:43:43 +0000 (22:43 +0000)]
Merge changes from topic "am-
a8794701-2d32-4392-bf6f-
9d00a3751e39" into nyc-mr2-dev
* changes:
[automerger] DO NOT MERGE: MCAP: Check response length in mca_ccb_hdl_rsp am:
840f70ca1e am:
c1f3afedf3 am:
3f5160f5aa am:
0f2de3c3df
[automerger] DO NOT MERGE: MCAP: Check response length in mca_ccb_hdl_rsp am:
840f70ca1e am:
c1f3afedf3 am:
3f5160f5aa
[automerger] DO NOT MERGE: MCAP: Check response length in mca_ccb_hdl_rsp am:
840f70ca1e am:
c1f3afedf3
[automerger] DO NOT MERGE: MCAP: Check response length in mca_ccb_hdl_rsp am:
840f70ca1e
DO NOT MERGE: MCAP: Check response length in mca_ccb_hdl_rsp
TreeHugger Robot [Fri, 2 Nov 2018 22:43:43 +0000 (22:43 +0000)]
Merge changes from topic "am-
a8794701-2d32-4392-bf6f-
9d00a3751e39" into cw-f-dev
* changes:
[automerger] DO NOT MERGE: MCAP: Check response length in mca_ccb_hdl_rsp am:
840f70ca1e am:
c1f3afedf3 am:
3f5160f5aa
[automerger] DO NOT MERGE: MCAP: Check response length in mca_ccb_hdl_rsp am:
840f70ca1e am:
c1f3afedf3
[automerger] DO NOT MERGE: MCAP: Check response length in mca_ccb_hdl_rsp am:
840f70ca1e
DO NOT MERGE: MCAP: Check response length in mca_ccb_hdl_rsp
TreeHugger Robot [Fri, 2 Nov 2018 22:43:43 +0000 (22:43 +0000)]
Merge changes from topic "am-
a8794701-2d32-4392-bf6f-
9d00a3751e39" into nyc-mr1-dev
* changes:
[automerger] DO NOT MERGE: MCAP: Check response length in mca_ccb_hdl_rsp am:
840f70ca1e am:
c1f3afedf3
[automerger] DO NOT MERGE: MCAP: Check response length in mca_ccb_hdl_rsp am:
840f70ca1e
DO NOT MERGE: MCAP: Check response length in mca_ccb_hdl_rsp
Chienyuan [Thu, 11 Oct 2018 02:36:57 +0000 (10:36 +0800)]
DO NOT MERGE HFP: Check AT command buffer boundary during parsing
* add p_end parameter to tBTA_AG_AT_CMD_CBACK, bta_ag_at_hsp_cback
and bta_ag_at_hfp_cback to indicate effective data range of p_arg
* add checks for buffer copy overflow in bta_ag_at_hsp_cback and
bta_ag_at_hfp_cback
* add packet legnth checks with p_end in bta_ag_parse_cmer
* add packet length checks with p_end in bta_ag_parse_bac
Bug:
112860487
Test: manual
Change-Id: Idbfa2b8bd4c1a0aeeacfe34349851b3bc8de7c69
Merged-In: Idbfa2b8bd4c1a0aeeacfe34349851b3bc8de7c69
(cherry picked from commit
5b1ef1038e3f4e4371c3d6718bf0f684be65eb2b)
Android Build Merger (Role) [Fri, 2 Nov 2018 22:10:06 +0000 (22:10 +0000)]
[automerger] DO NOT MERGE HFP: Check AT command buffer boundary during parsing am:
aea10aec7f am:
289b3fa863 skipped:
04ade0fdc0
Change-Id: Ibc39203eb7fa7c245d29013126e47c4638fd3c6b
Android Build Merger (Role) [Fri, 2 Nov 2018 22:10:05 +0000 (22:10 +0000)]
[automerger] DO NOT MERGE HFP: Check AT command buffer boundary during parsing am:
aea10aec7f am:
289b3fa863
Change-Id: I3510b09b67948fa640b028df8346077dc87ead51
Android Build Merger (Role) [Fri, 2 Nov 2018 22:10:04 +0000 (22:10 +0000)]
[automerger] DO NOT MERGE HFP: Check AT command buffer boundary during parsing am:
aea10aec7f
Change-Id: I15e13d82ec8f1aea4236044762e96e704f4275b2
Chienyuan [Thu, 11 Oct 2018 02:36:57 +0000 (10:36 +0800)]
DO NOT MERGE HFP: Check AT command buffer boundary during parsing
* add p_end parameter to tBTA_AG_AT_CMD_CBACK, bta_ag_at_hsp_cback
and bta_ag_at_hfp_cback to indicate effective data range of p_arg
* add checks for buffer copy overflow in bta_ag_at_hsp_cback and
bta_ag_at_hfp_cback
* add packet legnth checks with p_end in bta_ag_parse_cmer
* add packet length checks with p_end in bta_ag_parse_bac
Bug:
112860487
Test: manual
Change-Id: Idbfa2b8bd4c1a0aeeacfe34349851b3bc8de7c69
(cherry picked from commit
5b1ef1038e3f4e4371c3d6718bf0f684be65eb2b)
Ugo Yu [Fri, 2 Nov 2018 04:31:37 +0000 (21:31 -0700)]
[automerger skipped] Merge "DO NOT MERGE: Fix possible OOB when AVDT data channel recive ACL data" into oc-dev
am:
5b3764ada2 -s ours
Change-Id: If234a0b7b075098d8f42153138d5a72a78fb82b9
TreeHugger Robot [Fri, 2 Nov 2018 04:17:54 +0000 (04:17 +0000)]
Merge "DO NOT MERGE: Fix possible OOB when AVDT data channel recive ACL data" into oc-dev
Ugo Yu [Mon, 29 Oct 2018 16:47:04 +0000 (00:47 +0800)]
DO NOT MERGE: Fix possible OOB when AVDT data channel recive ACL data
Bug:
111450156
Change-Id: Id23eeedcb7bde5866cd53a2f7f1c30f27c5352f6
Merged-In: Id23eeedcb7bde5866cd53a2f7f1c30f27c5352f6
(cherry picked from commit
b0125caafec2183d73fc899ce5a8aee43a6e54af)
Ugo Yu [Thu, 1 Nov 2018 18:18:58 +0000 (11:18 -0700)]
Merge changes from topic "am-
6595535a-66ae-4551-9774-
048441013dbf" into oc-dev
am:
31d6e17ffa
Change-Id: Ic9a26f8c164d74731eda6ce98c26c60395e841a3
Ugo Yu [Thu, 1 Nov 2018 18:17:51 +0000 (11:17 -0700)]
Fix OOB in avrc_pars_browse_rsp
am:
32a33dc12d
Change-Id: I8b899527c6fe359dc0d4b009f539ef2b4270d7f7
TreeHugger Robot [Thu, 1 Nov 2018 18:04:03 +0000 (18:04 +0000)]
Merge changes from topic "am-
6595535a-66ae-4551-9774-
048441013dbf" into oc-dev
* changes:
[automerger] DO NOT MERGE: Fix possible OOB when AVDT data channel recive ACL data am:
ad4098c340 am:
8ee587afbb am:
bf3c65e987 am:
6055cb79e5 skipped:
36f3c8f9f3
[automerger] DO NOT MERGE: Fix possible OOB when AVDT data channel recive ACL data am:
ad4098c340 am:
8ee587afbb am:
bf3c65e987 am:
6055cb79e5
[automerger] DO NOT MERGE: Fix possible OOB when AVDT data channel recive ACL data am:
ad4098c340 am:
8ee587afbb am:
bf3c65e987
[automerger] DO NOT MERGE: Fix possible OOB when AVDT data channel recive ACL data am:
ad4098c340 am:
8ee587afbb
[automerger] DO NOT MERGE: Fix possible OOB when AVDT data channel recive ACL data am:
ad4098c340
DO NOT MERGE: Fix possible OOB when AVDT data channel recive ACL data
Android Build Merger (Role) [Thu, 1 Nov 2018 16:37:20 +0000 (16:37 +0000)]
[automerger] DO NOT MERGE: SDP: Check p_end in save_attr_seq and add_attr am:
2091fe7501 am:
4494b9be43 am:
07b95830b3 am:
e50ffa7119 skipped:
fc00aa02bf
Change-Id: I87a68dddfe4ef9a286300ba0544215150f047154
Android Build Merger (Role) [Thu, 1 Nov 2018 16:37:18 +0000 (16:37 +0000)]
[automerger] DO NOT MERGE: SDP: Check p_end in save_attr_seq and add_attr am:
2091fe7501 am:
4494b9be43 am:
07b95830b3 am:
e50ffa7119
Change-Id: Idb717d5895c454b7e7661c67a5aef275df7634e3
Android Build Merger (Role) [Thu, 1 Nov 2018 16:37:17 +0000 (16:37 +0000)]
[automerger] DO NOT MERGE: SDP: Check p_end in save_attr_seq and add_attr am:
2091fe7501 am:
4494b9be43 am:
07b95830b3
Change-Id: Ia5f3a475f290c5ebb76dd0256410cde567bb1e27
Android Build Merger (Role) [Thu, 1 Nov 2018 16:37:16 +0000 (16:37 +0000)]
[automerger] DO NOT MERGE: SDP: Check p_end in save_attr_seq and add_attr am:
2091fe7501 am:
4494b9be43
Change-Id: Ie42e3bd1a03ef61a7229ffa5d099127ee8048d2a
Android Build Merger (Role) [Thu, 1 Nov 2018 16:37:14 +0000 (16:37 +0000)]
[automerger] DO NOT MERGE: SDP: Check p_end in save_attr_seq and add_attr am:
2091fe7501
Change-Id: I4bdd3180984cb58b839a4d0625dfb37cb5a4e405
Myles Watson [Thu, 25 Oct 2018 00:05:12 +0000 (17:05 -0700)]
DO NOT MERGE: SDP: Check p_end in save_attr_seq and add_attr
Bug:
115900043
Test: Sanity pairing and SDP PTS
Change-Id: Ib642f79ed22b65ede5ff786cb1e163d172480f11
Android Build Merger (Role) [Thu, 1 Nov 2018 16:20:15 +0000 (16:20 +0000)]
[automerger] DO NOT MERGE: MCAP: Check response length in mca_ccb_hdl_rsp am:
840f70ca1e am:
c1f3afedf3 am:
3f5160f5aa am:
0f2de3c3df skipped:
a3dbdeece2
Change-Id: I5e93b174e09bd4f1c143c90d9d0808aaa21ae6b2
Android Build Merger (Role) [Thu, 1 Nov 2018 16:20:14 +0000 (16:20 +0000)]
[automerger] DO NOT MERGE: MCAP: Check response length in mca_ccb_hdl_rsp am:
840f70ca1e am:
c1f3afedf3 am:
3f5160f5aa am:
0f2de3c3df
Change-Id: I67e7de8e0560eb3d2bfd6b83c8318cf27235188b