From 0e68a1c94da846dc0734f3e0f982966741aa19a0 Mon Sep 17 00:00:00 2001 From: Cheney Ni Date: Wed, 8 Aug 2018 22:20:08 +0800 Subject: [PATCH] Checks the SMP length to fix OOB read Bug: 111937065 Test: manual Change-Id: I330880a6e1671d0117845430db4076dfe1aba688 Merged-In: I330880a6e1671d0117845430db4076dfe1aba688 (cherry picked from commit bc74f834741ddcb47de80b3572ce2eb4186c69e5) --- stack/smp/smp_act.cc | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/stack/smp/smp_act.cc b/stack/smp/smp_act.cc index 3cb12229e..171212233 100644 --- a/stack/smp/smp_act.cc +++ b/stack/smp/smp_act.cc @@ -908,6 +908,15 @@ void smp_proc_enc_info(tSMP_CB* p_cb, tSMP_INT_DATA* p_data) { uint8_t* p = p_data->p_data; SMP_TRACE_DEBUG("%s", __func__); + + if (smp_command_has_invalid_parameters(p_cb)) { + tSMP_INT_DATA smp_int_data; + smp_int_data.status = SMP_INVALID_PARAMETERS; + android_errorWriteLog(0x534e4554, "111937065"); + smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &smp_int_data); + return; + } + STREAM_TO_ARRAY(p_cb->ltk.data(), p, OCTET16_LEN); smp_key_distribution(p_cb, NULL); @@ -950,6 +959,15 @@ void smp_proc_id_info(tSMP_CB* p_cb, tSMP_INT_DATA* p_data) { uint8_t* p = p_data->p_data; SMP_TRACE_DEBUG("%s", __func__); + + if (smp_command_has_invalid_parameters(p_cb)) { + tSMP_INT_DATA smp_int_data; + smp_int_data.status = SMP_INVALID_PARAMETERS; + android_errorWriteLog(0x534e4554, "111937065"); + smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &smp_int_data); + return; + } + STREAM_TO_ARRAY(p_cb->tk.data(), p, OCTET16_LEN); /* reuse TK for IRK */ smp_key_distribution_by_transport(p_cb, NULL); } -- 2.11.0