OSDN Git Service
Ugo Yu [Mon, 29 Oct 2018 17:57:06 +0000 (01:57 +0800)]
DO NOT MERGE: Fix possible OOB when AVDT data channel recive ACL data
Bug:
111450156
Change-Id: Id23eeedcb7bde5866cd53a2f7f1c30f27c5352f6
(cherry picked from commit
b0125caafec2183d73fc899ce5a8aee43a6e54af)
Jakub Pawlowski [Wed, 10 Oct 2018 18:07:12 +0000 (20:07 +0200)]
Fix possible OOB read in process_service_search_rsp
Bug:
74249842
Change-Id: I0dbe43f0da1f5a8f14bcb69659752de4bd70ca98
Merged-In: I0dbe43f0da1f5a8f14bcb69659752de4bd70ca98
Ugo Yu [Tue, 18 Sep 2018 12:49:22 +0000 (20:49 +0800)]
DO NOT MERGE - Check SDU lower bound before allocate p_data
Bug:
112321180
Test: SL4A BleCocTest:test_coc_insecured_connection_write_ascii
Change-Id: Id0c9aa2097f0b6bdc2bb9fa9086daa9452188e1d
TreeHugger Robot [Fri, 7 Sep 2018 16:16:19 +0000 (16:16 +0000)]
Merge "DO NOT MERGE - Check data length when parsing AVRCP vendor specific command responses" into nyc-dev
Pavlin Radoslavov [Thu, 6 Sep 2018 22:41:27 +0000 (15:41 -0700)]
DO NOT MERGE - Check AVRCP data length when parsing inside avrc_ctrl_pars_vendor_rsp()
Bug:
111450417
Test: PoC test program
Change-Id: Idd619e52dc7a2944d0d08af824505580e299c163
(cherry picked from commit
2692408d05bf16738284b61833649cee5d2a2233)
Pavlin Radoslavov [Thu, 6 Sep 2018 01:21:31 +0000 (18:21 -0700)]
DO NOT MERGE - Check data length when parsing AVRCP vendor specific command responses
Bug:
111450531
Bug:
111896861
Test: PoC test program
Change-Id: I564bee8f05efabc29383659a75e695b4da76c6aa
(cherry picked from commit
7439ea940354f65a147c4ecfce3bada49c688047)
TreeHugger Robot [Fri, 10 Aug 2018 23:13:53 +0000 (23:13 +0000)]
Merge "Checks the SMP length to fix OOB read" into nyc-dev
TreeHugger Robot [Fri, 10 Aug 2018 20:55:20 +0000 (20:55 +0000)]
Merge "DO NOT MERGE Add packet length check in smp_proc_master_id" into nyc-dev
TreeHugger Robot [Fri, 10 Aug 2018 20:06:42 +0000 (20:06 +0000)]
Merge "DO NOT MERGE: Add missing AVRCP message length checks inside avrc_msg_cback" into nyc-dev
TreeHugger Robot [Fri, 10 Aug 2018 19:52:34 +0000 (19:52 +0000)]
Merge "DO NOT MERGE Check packet length in bta_av_proc_meta_cmd" into nyc-dev
TreeHugger Robot [Fri, 10 Aug 2018 19:43:29 +0000 (19:43 +0000)]
Merge "DO NOT MERGE Fix OOB read before buffer length check" into nyc-dev
Ugo Yu [Wed, 8 Aug 2018 08:18:08 +0000 (16:18 +0800)]
DO NOT MERGE Add packet length check in smp_proc_master_id
Bug:
111937027
Test: manual
Change-Id: I2009b6be38f9733931e625379b035e84371fdcaf
Cheney Ni [Wed, 8 Aug 2018 14:40:27 +0000 (22:40 +0800)]
Checks the SMP length to fix OOB read
Bug:
111937065
Test: manual
Change-Id: I330880a6e1671d0117845430db4076dfe1aba688
Merged-In: I330880a6e1671d0117845430db4076dfe1aba688
Jakub Pawlowski [Mon, 16 Jul 2018 13:40:35 +0000 (06:40 -0700)]
Fix copy length calculation in sdp_copy_raw_data
Test: compilation
Bug:
110216176
Change-Id: Ic4a19c9f0fe8cd592bc6c25dcec7b1da49ff7459
Merged-In: Ic4a19c9f0fe8cd592bc6c25dcec7b1da49ff7459
TreeHugger Robot [Fri, 10 Aug 2018 00:39:29 +0000 (00:39 +0000)]
Merge "DO NOT MERGE Fix OOB read in avrc_ctrl_pars_vendor_rsp" into nyc-dev
Hansong Zhang [Thu, 9 Aug 2018 23:43:44 +0000 (23:43 +0000)]
Merge "DO NOT MERGE Check remaining frame length in rfc_process_mx_message" into nyc-dev
Hansong Zhang [Wed, 8 Aug 2018 18:38:30 +0000 (11:38 -0700)]
DO NOT MERGE Check remaining frame length in rfc_process_mx_message
Bug:
111936792
Bug:
80432928
Test: manual
Change-Id: Ie2c09f3d598fb230ce060c9043f5a88c241cdd79
Pavlin Radoslavov [Thu, 9 Aug 2018 20:40:54 +0000 (13:40 -0700)]
DO NOT MERGE: Add missing AVRCP message length checks inside avrc_msg_cback
Explicitly check the length of the received message before
accessing the data.
Bug:
111803925
Bug:
79883824
Test: POC scripts
Change-Id: I50d1d1f7dd7038ffcd5f0d5975ab1db43178067f
Merged-In: I00b1c6bd6dd7e18ac2c469ef2032c7ff10dcaecb
Cheney Ni [Tue, 7 Aug 2018 13:32:07 +0000 (21:32 +0800)]
DO NOT MERGE: Add packet length checks in mca_ccb_hdl_req
Bug:
110791536
Test: manual
Change-Id: Ica5d8037246682fdb190b2747a86ed8d44c2869a
Chienyuan [Wed, 8 Aug 2018 08:15:21 +0000 (16:15 +0800)]
DO NOT MERGE Check packet length in bta_av_proc_meta_cmd
Bug:
111893951
Test: manual
Change-Id: Ie562c393e949c275203617972d43bb005190b32b
Ugo Yu [Wed, 8 Aug 2018 06:57:25 +0000 (14:57 +0800)]
DO NOT MERGE Fix OOB read before buffer length check
Bug:
111936834
Test: manual
Change-Id: I60c500651f130876934a7b80889f4e021055fe73
Hansong Zhang [Mon, 6 Aug 2018 21:36:41 +0000 (14:36 -0700)]
DO NOT MERGE Fix OOB read in avrc_ctrl_pars_vendor_rsp
Bug:
78526423
Test: manual
Change-Id: I0eeacc6a25b12f4b999098375d0d032cfa462a91
TreeHugger Robot [Fri, 20 Jul 2018 18:25:33 +0000 (18:25 +0000)]
Merge "DO NOT MERGE SDP: Fix the param_len recalculation" into nyc-dev
Hansong Zhang [Fri, 20 Jul 2018 17:16:14 +0000 (10:16 -0700)]
DO NOT MERGE SDP: Fix the param_len recalculation
Bug:
78136869
Test: manual connection to an A2DP device
Change-Id: If32b848696180ab2fd33f514de89cb8c3d202e39
Android Build Merger (Role) [Fri, 20 Jul 2018 17:17:18 +0000 (17:17 +0000)]
[automerger] DO NOT MERGE SDP: Fix the param_len recalculation am:
7b2d711d9e am:
43d4bf00eb am:
7d92fdbb23 skipped:
58417f9233
Change-Id: I5429442640a203df07ba448e8b9837fb8017eb6d
Android Build Merger (Role) [Fri, 20 Jul 2018 17:17:17 +0000 (17:17 +0000)]
[automerger] DO NOT MERGE SDP: Fix the param_len recalculation am:
7b2d711d9e am:
43d4bf00eb am:
7d92fdbb23
Change-Id: Ie9d7f0209ad248035cb65c9e6d04236ba61a9264
Android Build Merger (Role) [Fri, 20 Jul 2018 17:17:15 +0000 (17:17 +0000)]
[automerger] DO NOT MERGE SDP: Fix the param_len recalculation am:
7b2d711d9e am:
43d4bf00eb
Change-Id: Iea2346e652fe6bb086e894615bb409491d60457d
Android Build Merger (Role) [Fri, 20 Jul 2018 17:17:14 +0000 (17:17 +0000)]
[automerger] DO NOT MERGE SDP: Fix the param_len recalculation am:
7b2d711d9e
Change-Id: I1adfd8dd7cd684e5d9af4a1967f0630e53fe035f
Hansong Zhang [Fri, 20 Jul 2018 17:16:14 +0000 (10:16 -0700)]
DO NOT MERGE SDP: Fix the param_len recalculation
Bug:
78136869
Test: manual connection to an A2DP device
Change-Id: If32b848696180ab2fd33f514de89cb8c3d202e39
Hansong Zhang [Fri, 13 Jul 2018 20:43:27 +0000 (13:43 -0700)]
DO NOT MERGE Fix a wrong check in rfc_parse_data
Bug:
78288018
Bug:
111436796
Test: manual
Change-Id: I16e6026acbaac230fe1453bbac040d1b75bcea2a
Hansong Zhang [Thu, 7 Jun 2018 23:11:27 +0000 (16:11 -0700)]
DO NOT MERGE Add bound check for rfc_parse_data
Bug:
78288018
Test: manual
Change-Id: I44349cd22c141483d01bce0f5a2131b727d0feb0
Merged-In: I44349cd22c141483d01bce0f5a2131b727d0feb0
(cherry picked from commit
1b9a465eea85e86984bb1e53be69880159e59c69)
Android Build Merger (Role) [Fri, 13 Jul 2018 16:16:15 +0000 (16:16 +0000)]
[automerger skipped] Add bound check for rfc_parse_data skipped:
1b9a465eea skipped:
5741c6951e skipped:
aa697e3f87 skipped:
b1f262ed40
Change-Id: I7b848bbdf257721c4f653daeb531ec2f6be4a6ad
Android Build Merger (Role) [Fri, 13 Jul 2018 16:16:13 +0000 (16:16 +0000)]
[automerger skipped] Add bound check for rfc_parse_data skipped:
1b9a465eea skipped:
5741c6951e skipped:
aa697e3f87
Change-Id: Ibc434fafa8043a4c9b42e26a80d893441a4cef27
Android Build Merger (Role) [Fri, 13 Jul 2018 16:16:11 +0000 (16:16 +0000)]
[automerger skipped] Add bound check for rfc_parse_data skipped:
1b9a465eea skipped:
5741c6951e
Change-Id: I0e691f7030013c84b90a10e20e67274ac2408025
Android Build Merger (Role) [Fri, 13 Jul 2018 16:16:09 +0000 (16:16 +0000)]
[automerger skipped] Add bound check for rfc_parse_data skipped:
1b9a465eea
Change-Id: I4c80ed01bf081bfe6ab6d27fcbb5b685309fb2a2
Hansong Zhang [Thu, 7 Jun 2018 23:11:27 +0000 (16:11 -0700)]
Add bound check for rfc_parse_data
Bug:
78288018
Test: manual
Change-Id: I44349cd22c141483d01bce0f5a2131b727d0feb0
Merged-In: I44349cd22c141483d01bce0f5a2131b727d0feb0
Android Build Merger (Role) [Fri, 13 Jul 2018 12:47:07 +0000 (12:47 +0000)]
[automerger] Fix out of bounds read in l2c_rcv_acl_data am:
9bf8cb2683 am:
4a370bbdc5 am:
2e08a14470 skipped:
e4460d953d
Change-Id: I0f7cd1a1d7e309db38eee7ae86ed761710a9bfb0
Android Build Merger (Role) [Fri, 13 Jul 2018 12:43:31 +0000 (12:43 +0000)]
[automerger] Fix out of bounds read in l2c_rcv_acl_data am:
9bf8cb2683 am:
4a370bbdc5 am:
2e08a14470
Change-Id: I6cd95ab6a7bf2509ef888134ff6a4d0aa18f4ac5
Android Build Merger (Role) [Fri, 13 Jul 2018 12:43:29 +0000 (12:43 +0000)]
[automerger] Fix out of bounds read in l2c_rcv_acl_data am:
9bf8cb2683 am:
4a370bbdc5
Change-Id: I289ef3ff584a174372e89b692aee08076e7f97ed
Android Build Merger (Role) [Fri, 13 Jul 2018 12:43:26 +0000 (12:43 +0000)]
[automerger] Fix out of bounds read in l2c_rcv_acl_data am:
9bf8cb2683
Change-Id: Ia857465d9a103a44d6219f90bcf606e23a712166
Jakub Pawlowski [Fri, 22 Jun 2018 09:57:19 +0000 (02:57 -0700)]
Fix out of bounds read in l2c_rcv_acl_data
Test: none
Bug:
80432895
Change-Id: I7807d00c02a84c545476e84bc1b71e0718df1f24
Merged-In: I7807d00c02a84c545476e84bc1b71e0718df1f24
Jakub Pawlowski [Fri, 13 Jul 2018 12:42:53 +0000 (12:42 +0000)]
Merge "Fix out of bounds read in l2c_rcv_acl_data" into nyc-dev
Android Build Merger (Role) [Fri, 13 Jul 2018 10:21:54 +0000 (10:21 +0000)]
[automerger] BLE: Don't access freed buffer in log message am:
6c7c67817d am:
ee283d67bf am:
ba7e4b88ca am:
36f5050f23
Change-Id: If437e47efd744648d5549e23793894de40281b10
Android Build Merger (Role) [Fri, 13 Jul 2018 10:21:51 +0000 (10:21 +0000)]
[automerger] BLE: Don't access freed buffer in log message am:
6c7c67817d am:
ee283d67bf am:
ba7e4b88ca
Change-Id: I4d7c71a8cec14b94039657bd8de3679a776c473e
Android Build Merger (Role) [Fri, 13 Jul 2018 10:21:48 +0000 (10:21 +0000)]
[automerger] BLE: Don't access freed buffer in log message am:
6c7c67817d am:
ee283d67bf
Change-Id: I2dcc552158cfc27c73dec217d7f3e2581adf2426
Android Build Merger (Role) [Fri, 13 Jul 2018 10:21:46 +0000 (10:21 +0000)]
[automerger] BLE: Don't access freed buffer in log message am:
6c7c67817d
Change-Id: I9f5c4155c1def43351058c6cbda5f1258e3888d5
Nitin Shivpure [Tue, 6 Feb 2018 12:48:37 +0000 (18:18 +0530)]
BLE: Don't access freed buffer in log message
When GATT fail to write data on L2CAP, buffer is freed by L2CAP.
Accessing the buffer leads to fatal failure while printing the message info.
Test: BLE discover services and BT off test cases
Fixes:
73018520
Change-Id: I661398fd1321f6e68026b3720db4965fd6584d70
Merged-In: I661398fd1321f6e68026b3720db4965fd6584d70
Jakub Pawlowski [Fri, 22 Jun 2018 09:57:19 +0000 (02:57 -0700)]
Fix out of bounds read in l2c_rcv_acl_data
Test: none
Bug:
80432895
Change-Id: I7807d00c02a84c545476e84bc1b71e0718df1f24
Merged-In: I7807d00c02a84c545476e84bc1b71e0718df1f24
Android Build Merger (Role) [Fri, 13 Jul 2018 09:17:18 +0000 (09:17 +0000)]
[automerger] Add packet length checks in l2cble_process_sig_cmd am:
3a0aab555f am:
497f11b0fd am:
98366e0b06 skipped:
d5ef3c9e76
Change-Id: I88b6879652a667ace51c8e304eeeb0f394493b58
Android Build Merger (Role) [Fri, 13 Jul 2018 09:16:03 +0000 (09:16 +0000)]
[automerger] Add packet length checks in l2cble_process_sig_cmd am:
3a0aab555f am:
497f11b0fd am:
98366e0b06
Change-Id: Iebe8378ad968c488cbc4b88a986566d40c4bae07
Android Build Merger (Role) [Fri, 13 Jul 2018 09:16:01 +0000 (09:16 +0000)]
[automerger] Add packet length checks in l2cble_process_sig_cmd am:
3a0aab555f am:
497f11b0fd
Change-Id: Ia9dfcc76e8a3a464d1d000e59c998d7958119e83
Android Build Merger (Role) [Fri, 13 Jul 2018 09:15:58 +0000 (09:15 +0000)]
[automerger] Add packet length checks in l2cble_process_sig_cmd am:
3a0aab555f
Change-Id: If6a5bdde9eee5540844938956063199c9e640da3
Jakub Pawlowski [Fri, 22 Jun 2018 05:56:11 +0000 (22:56 -0700)]
Add packet length checks in l2cble_process_sig_cmd
Bug:
80261585
Test: compilation
Change-Id: Icf55747dc948bcce140a12658237554938e2d717
Merged-In: Icf55747dc948bcce140a12658237554938e2d717
Jakub Pawlowski [Wed, 11 Jul 2018 09:57:07 +0000 (02:57 -0700)]
Don't use Address after it was deleted
Bug:
110216173
Change-Id: Id3364cf53153eafed478546d7347ed1673217e91
Merged-In: Id3364cf53153eafed478546d7347ed1673217e91
Jakub Pawlowski [Fri, 22 Jun 2018 05:56:11 +0000 (22:56 -0700)]
Add packet length checks in l2cble_process_sig_cmd
Bug:
80261585
Test: compilation
Change-Id: Icf55747dc948bcce140a12658237554938e2d717
Merged-In: Icf55747dc948bcce140a12658237554938e2d717
TreeHugger Robot [Thu, 12 Jul 2018 22:28:54 +0000 (22:28 +0000)]
Merge "DO NOT MERGE HID Host: Check L2CAP packet data length" into nyc-dev
TreeHugger Robot [Thu, 12 Jul 2018 22:17:26 +0000 (22:17 +0000)]
Merge changes from topic "am-
de483eec-fa20-48e1-8e14-
9d6660359644" into mnc-dr1.5-dev
* changes:
[automerger] DO NOT MERGE HID Host: Check L2CAP packet data length am:
2da73209f2 am:
7d941ad3a2 am:
56c5b8f060
[automerger] DO NOT MERGE HID Host: Check L2CAP packet data length am:
2da73209f2 am:
7d941ad3a2
[automerger] DO NOT MERGE HID Host: Check L2CAP packet data length am:
2da73209f2
DO NOT MERGE HID Host: Check L2CAP packet data length
TreeHugger Robot [Thu, 12 Jul 2018 22:17:26 +0000 (22:17 +0000)]
Merge changes from topic "am-
de483eec-fa20-48e1-8e14-
9d6660359644" into cw-e-dev
* changes:
[automerger] DO NOT MERGE HID Host: Check L2CAP packet data length am:
2da73209f2 am:
7d941ad3a2
[automerger] DO NOT MERGE HID Host: Check L2CAP packet data length am:
2da73209f2
DO NOT MERGE HID Host: Check L2CAP packet data length
TreeHugger Robot [Thu, 12 Jul 2018 22:17:26 +0000 (22:17 +0000)]
Merge changes from topic "am-
de483eec-fa20-48e1-8e14-
9d6660359644" into mnc-dr-dev
* changes:
[automerger] DO NOT MERGE HID Host: Check L2CAP packet data length am:
2da73209f2
DO NOT MERGE HID Host: Check L2CAP packet data length
TreeHugger Robot [Thu, 12 Jul 2018 22:17:26 +0000 (22:17 +0000)]
Merge "DO NOT MERGE HID Host: Check L2CAP packet data length" into mnc-dev
TreeHugger Robot [Thu, 12 Jul 2018 22:17:26 +0000 (22:17 +0000)]
Merge changes from topic "am-
de483eec-fa20-48e1-8e14-
9d6660359644" into nyc-dev
* changes:
[automerger] DO NOT MERGE HID Host: Check L2CAP packet data length am:
2da73209f2 am:
7d941ad3a2 am:
56c5b8f060 skipped:
a8668154b7
[automerger] DO NOT MERGE HID Host: Check L2CAP packet data length am:
2da73209f2 am:
7d941ad3a2 am:
56c5b8f060
[automerger] DO NOT MERGE HID Host: Check L2CAP packet data length am:
2da73209f2 am:
7d941ad3a2
[automerger] DO NOT MERGE HID Host: Check L2CAP packet data length am:
2da73209f2
DO NOT MERGE HID Host: Check L2CAP packet data length
TreeHugger Robot [Thu, 12 Jul 2018 21:10:42 +0000 (21:10 +0000)]
Merge "DO NOT MERGE Fix OOB read in process_l2cap_cmd" into nyc-dev
Hansong Zhang [Thu, 12 Jul 2018 18:00:53 +0000 (11:00 -0700)]
DO NOT MERGE Fix OOB read in process_l2cap_cmd
Test: manual
Bug:
79488381
Change-Id: I723866ed40d3647fed99875f659bb95df96a6969
Android Build Merger (Role) [Thu, 12 Jul 2018 07:41:15 +0000 (07:41 +0000)]
[automerger] SDP: return error on offset bigger than atribute length am:
3565eaf72d am:
67c78b25ca am:
1c4f9c9624 am:
05ba05199c
Change-Id: I95b70f63b81df6f58b516b83853fc0bbef7eccc8
Android Build Merger (Role) [Thu, 12 Jul 2018 07:41:12 +0000 (07:41 +0000)]
[automerger] SDP: return error on offset bigger than atribute length am:
3565eaf72d am:
67c78b25ca am:
1c4f9c9624
Change-Id: Idb5ac3b18ec180a90eca120754d601c1ba68edbf
Android Build Merger (Role) [Thu, 12 Jul 2018 07:41:10 +0000 (07:41 +0000)]
[automerger] SDP: return error on offset bigger than atribute length am:
3565eaf72d am:
67c78b25ca
Change-Id: I3e68fbd29ce151c4829fe6077d76bc3822915c8f
Android Build Merger (Role) [Thu, 12 Jul 2018 07:41:07 +0000 (07:41 +0000)]
[automerger] SDP: return error on offset bigger than atribute length am:
3565eaf72d
Change-Id: Ic7b10e46c591edff7f86c06dee6beb8ca8798121
Jakub Pawlowski [Fri, 22 Jun 2018 11:46:39 +0000 (04:46 -0700)]
SDP: return error on offset bigger than atribute length
Test: none
Bug:
79217770
Change-Id: I8b594882dd07644b1a747c53d6166db466b7e998
Merged-In: I8b594882dd07644b1a747c53d6166db466b7e998
TreeHugger Robot [Wed, 11 Jul 2018 17:36:21 +0000 (17:36 +0000)]
Merge "DO NOT MERGE HFP: Fix out of bound access in phone number processing" into nyc-dev
Jack He [Wed, 27 Jun 2018 00:53:24 +0000 (17:53 -0700)]
DO NOT MERGE HFP: Fix out of bound access in phone number processing
* Write at most sizeof(dialnum) chars into dialnum array in ClccResponse
method
* Write at most sizeof(ag_res.str) - 5 chars into ag_res.str array in
PhoneStateChange method
Bug:
79431031
Bug:
79266386
Test: make call with super long phone numbers
Change-Id: I98e7687ac4055800aa46626c6b1c866e52e474df
Merged-In: I98e7687ac4055800aa46626c6b1c866e52e474df
Hansong Zhang [Thu, 7 Jun 2018 21:18:22 +0000 (14:18 -0700)]
DO NOT MERGE HID Host: Check L2CAP packet data length
Bug:
80493272
Test: manual
Change-Id: I8b1acd11616684729752195fabb4fa34c46a508d
Android Build Merger (Role) [Thu, 7 Jun 2018 21:27:51 +0000 (21:27 +0000)]
[automerger] DO NOT MERGE HID Host: Check L2CAP packet data length am:
2da73209f2 am:
7d941ad3a2 am:
56c5b8f060 skipped:
a8668154b7
Change-Id: Ib12a006ee1c5d3ed781e674e2091b7bf8c30036b
Android Build Merger (Role) [Thu, 7 Jun 2018 21:27:49 +0000 (21:27 +0000)]
[automerger] DO NOT MERGE HID Host: Check L2CAP packet data length am:
2da73209f2 am:
7d941ad3a2 am:
56c5b8f060
Change-Id: I999dbbc621168887e993159271c59aa526af4d8e
Android Build Merger (Role) [Thu, 7 Jun 2018 21:27:47 +0000 (21:27 +0000)]
[automerger] DO NOT MERGE HID Host: Check L2CAP packet data length am:
2da73209f2 am:
7d941ad3a2
Change-Id: I98eea999519f71f72df32c82a42ebcaae9aeb95f
Android Build Merger (Role) [Thu, 7 Jun 2018 21:27:45 +0000 (21:27 +0000)]
[automerger] DO NOT MERGE HID Host: Check L2CAP packet data length am:
2da73209f2
Change-Id: I4356335c6ee6b0e3717e22d94ff9e8bb0574e663
Hansong Zhang [Thu, 7 Jun 2018 21:02:30 +0000 (14:02 -0700)]
DO NOT MERGE HID Host: Check L2CAP packet data length
Bug:
80493272
Test: manual
Change-Id: I8b1acd11616684729752195fabb4fa34c46a508d
TreeHugger Robot [Thu, 7 Jun 2018 01:53:54 +0000 (01:53 +0000)]
Merge "DO NOT MERGE: Don't reuse buffer when building response" into nyc-dev
Ajay Panicker [Wed, 6 Jun 2018 21:58:54 +0000 (14:58 -0700)]
DO NOT MERGE: Don't reuse buffer when building response
Bug:
79541338
Test: Compile and connect to remote headset
Change-Id: I5e059615db589e165630f39d631a922006c2d70f
Android Build Merger (Role) [Thu, 7 Jun 2018 00:43:23 +0000 (00:43 +0000)]
[automerger] DO NOT MERGE: Don't reuse buffer when building response am:
5b27fef4d8 am:
4d07934351 am:
690cc6b25d skipped:
c4d802659d
Change-Id: I5d7ceaba658d90e8a8931b50a6c8774f2c690b5d
Android Build Merger (Role) [Thu, 7 Jun 2018 00:43:21 +0000 (00:43 +0000)]
[automerger] DO NOT MERGE: Don't reuse buffer when building response am:
5b27fef4d8 am:
4d07934351 am:
690cc6b25d
Change-Id: I9d251934afe063299b4b7f36ea63c214b5188577
Android Build Merger (Role) [Thu, 7 Jun 2018 00:43:20 +0000 (00:43 +0000)]
[automerger] DO NOT MERGE: Don't reuse buffer when building response am:
5b27fef4d8 am:
4d07934351
Change-Id: I7b8076d21aeeb80c469764d0643ee54e9de049ff
Android Build Merger (Role) [Thu, 7 Jun 2018 00:43:18 +0000 (00:43 +0000)]
[automerger] DO NOT MERGE: Don't reuse buffer when building response am:
5b27fef4d8
Change-Id: I73fc976256c6af11d7431778b3c962a2816f5f5f
Ajay Panicker [Wed, 6 Jun 2018 21:29:59 +0000 (14:29 -0700)]
DO NOT MERGE: Don't reuse buffer when building response
Bug:
79541338
Test: Compile and connect to remote headset
Change-Id: I2c00660bb551bbac58df88d2df07c98a30871e58
Android Build Merger (Role) [Tue, 5 Jun 2018 03:48:20 +0000 (03:48 +0000)]
[automerger] Add checks whether the AVDTP element data length is valid am:
e192c988cb am:
6b2f63f880 am:
ac8793939a am:
862eb4827b
Change-Id: I336035e480bcd33d67b90543a9f81fe919dc649a
Android Build Merger (Role) [Tue, 5 Jun 2018 03:48:17 +0000 (03:48 +0000)]
[automerger] Add checks whether the AVDTP element data length is valid am:
e192c988cb am:
6b2f63f880 am:
ac8793939a
Change-Id: Ibde13c7a9f0af5a7e4f38db226532780b8fc50fa
Android Build Merger (Role) [Tue, 5 Jun 2018 03:48:15 +0000 (03:48 +0000)]
[automerger] Add checks whether the AVDTP element data length is valid am:
e192c988cb am:
6b2f63f880
Change-Id: I874adb503bb51f88ad7a934b697221f544fc5488
Android Build Merger (Role) [Tue, 5 Jun 2018 03:48:12 +0000 (03:48 +0000)]
[automerger] Add checks whether the AVDTP element data length is valid am:
e192c988cb
Change-Id: I945a8ce34b41a7df4a3c853ad5b4ba51d0136251
Pavlin Radoslavov [Thu, 31 May 2018 17:23:02 +0000 (10:23 -0700)]
Add checks whether the AVDTP element data length is valid
Bug:
78288378
Test: Manual: Python script and extra logging
Change-Id: I576d798d8b566946a3f2d973cb9d4e8dbd22d09e
Merged-In: I715b5977c833d33ff798f008fbf244effa13ea1f
Jack He [Tue, 5 Jun 2018 00:40:42 +0000 (17:40 -0700)]
DO NOT MERGE BNEP: Fix build breakage by using osi_free instead of GKI_freebuf
Bug:
79164722
Bug:
78286118
Test: make
Change-Id: I04fc994d9bca80aa4711118d3c5be02f2b809a48
Android Build Merger (Role) [Mon, 4 Jun 2018 23:10:07 +0000 (23:10 +0000)]
[automerger] BNEP: Fix OOB access in bnep_data_ind am:
0bd01271c4 am:
8f9b349c23 am:
81dcda9a5a am:
eee28a5a06
Change-Id: I5018c4115f5502d5f88c955f77221339663eca91
Android Build Merger (Role) [Mon, 4 Jun 2018 23:10:05 +0000 (23:10 +0000)]
[automerger] BNEP: Fix OOB access in bnep_data_ind am:
0bd01271c4 am:
8f9b349c23 am:
81dcda9a5a
Change-Id: I1cd6cf2b54334cff0bb8568cb0dd5ef6121ca444
Android Build Merger (Role) [Mon, 4 Jun 2018 23:10:03 +0000 (23:10 +0000)]
[automerger] BNEP: Fix OOB access in bnep_data_ind am:
0bd01271c4 am:
8f9b349c23
Change-Id: I404328203b34b5e48d2d5fbca3667e9dac9ca742
Android Build Merger (Role) [Mon, 4 Jun 2018 23:10:01 +0000 (23:10 +0000)]
[automerger] BNEP: Fix OOB access in bnep_data_ind am:
0bd01271c4
Change-Id: I12f77728b3ad0f10b3cd0f34a7068272573e6ea4
Jack He [Fri, 1 Jun 2018 21:00:42 +0000 (14:00 -0700)]
BNEP: Fix OOB access in bnep_data_ind
* Stop reading the L2CAP packet if packet length is 0
* Process the buffer for BNEP_EXTENSION_CONTROL packet before advancing
the buffer pointer by length of payload
* Reject BNEP_EXTENSION_CONTROL packet when the payload size is zero
* Move error logging to more appropriate locations at where the OOB access
is most likely triggered
Bug:
78286118
Bug:
79164722
Test: Send zero length L2CAP packet to BNEP, send invalid
BNEP_EXTENSION_CONTROL packet
Change-Id: I7e18632b8faab1b6aaca1bff1b7f55d69962729e
Merged-In: I7e18632b8faab1b6aaca1bff1b7f55d69962729e
(cherry picked from commit
3c799a6e25abdf6bacb660ff7a06338836cc7356)
Android Build Merger (Role) [Fri, 1 Jun 2018 19:11:22 +0000 (19:11 +0000)]
[automerger] Fixes two bluetooth bugs causing remote overreads (2/2) am:
0a8453ba41 am:
f60bc5a9a8 am:
9619144b16 am:
b37a3d0a19
Change-Id: I95a38db1c94e545a10f894f56319cb9b38c465fa
Android Build Merger (Role) [Fri, 1 Jun 2018 19:11:21 +0000 (19:11 +0000)]
[automerger] Fixes two bluetooth bugs causing remote overreads (2/2) am:
0a8453ba41 am:
f60bc5a9a8 am:
9619144b16
Change-Id: I164001793fe32ef903c430594d93dc800e8c396f
Android Build Merger (Role) [Fri, 1 Jun 2018 19:11:19 +0000 (19:11 +0000)]
[automerger] Fixes two bluetooth bugs causing remote overreads (2/2) am:
0a8453ba41 am:
f60bc5a9a8
Change-Id: I36cca997401a549ed94036dd48efa7ba00d73fd4
Android Build Merger (Role) [Fri, 1 Jun 2018 19:11:17 +0000 (19:11 +0000)]
[automerger] Fixes two bluetooth bugs causing remote overreads (2/2) am:
0a8453ba41
Change-Id: I9a8fc8c90e84297bde904dc30c31c745e0e15cbd
akirilov [Fri, 27 Apr 2018 22:05:14 +0000 (15:05 -0700)]
Fixes two bluetooth bugs causing remote overreads (2/2)
Bug:
74075873
Test: manual
Change-Id: I28a78084a1ab451b407ee6e7a5495c1e43ed757b
Merged-In: I76058b11c90dc40b78f26fb64b74d609f3473f5d
Android Build Merger (Role) [Thu, 31 May 2018 22:59:12 +0000 (22:59 +0000)]
[automerger] Decrease length after reading from array in process_service_attr_req am:
76e962892e am:
7c0954970d am:
a2c06775c0 am:
c1b04d4179
Change-Id: I3aa367983196c35c902d46e96b82378acd1b2e2b
OSDN Git Service
