From 38f07a3c93143ca31229f0caa5b1a270dc1f5401 Mon Sep 17 00:00:00 2001 From: Hansong Zhang Date: Fri, 18 Jan 2019 11:51:00 -0800 Subject: [PATCH] DO NOT MERGE process_l2cap_cmd: Fix OOB Bug: 119870451 Test: POC Change-Id: Ieef322a3ad4cebcaf40e5388584d3a04a4761d2e --- stack/l2cap/l2c_main.c | 36 ++++++++++++++++++++++++++++++------ stack/l2cap/l2c_utils.c | 3 +++ 2 files changed, 33 insertions(+), 6 deletions(-) diff --git a/stack/l2cap/l2c_main.c b/stack/l2cap/l2c_main.c index cbf30b1c0..6720814d8 100644 --- a/stack/l2cap/l2c_main.c +++ b/stack/l2cap/l2c_main.c @@ -488,7 +488,11 @@ static void process_l2cap_cmd (tL2C_LCB *p_lcb, UINT8 *p, UINT16 pkt_len) { case L2CAP_CFG_TYPE_MTU: cfg_info.mtu_present = TRUE; - if (p + 2 > p_next_cmd) { + if (cfg_len != 2) { + android_errorWriteLog(0x534e4554, "119870451"); + return; + } + if (p + cfg_len > p_next_cmd) { android_errorWriteLog(0x534e4554, "74202041"); return; } @@ -497,7 +501,11 @@ static void process_l2cap_cmd (tL2C_LCB *p_lcb, UINT8 *p, UINT16 pkt_len) case L2CAP_CFG_TYPE_FLUSH_TOUT: cfg_info.flush_to_present = TRUE; - if (p + 2 > p_next_cmd) { + if (cfg_len != 2) { + android_errorWriteLog(0x534e4554, "119870451"); + return; + } + if (p + cfg_len > p_next_cmd) { android_errorWriteLog(0x534e4554, "74202041"); return; } @@ -506,7 +514,11 @@ static void process_l2cap_cmd (tL2C_LCB *p_lcb, UINT8 *p, UINT16 pkt_len) case L2CAP_CFG_TYPE_QOS: cfg_info.qos_present = TRUE; - if (p + 2 + 5 * 4 > p_next_cmd) { + if (cfg_len != 2 + 5 * 4) { + android_errorWriteLog(0x534e4554, "119870451"); + return; + } + if (p + cfg_len > p_next_cmd) { android_errorWriteLog(0x534e4554, "74202041"); return; } @@ -521,7 +533,11 @@ static void process_l2cap_cmd (tL2C_LCB *p_lcb, UINT8 *p, UINT16 pkt_len) case L2CAP_CFG_TYPE_FCR: cfg_info.fcr_present = TRUE; - if (p + 3 + 3 * 2 > p_next_cmd) { + if (cfg_len != 3 + 3 * 2) { + android_errorWriteLog(0x534e4554, "119870451"); + return; + } + if (p + cfg_len > p_next_cmd) { android_errorWriteLog(0x534e4554, "74202041"); return; } @@ -535,7 +551,11 @@ static void process_l2cap_cmd (tL2C_LCB *p_lcb, UINT8 *p, UINT16 pkt_len) case L2CAP_CFG_TYPE_FCS: cfg_info.fcs_present = TRUE; - if (p + 1 > p_next_cmd) { + if (cfg_len != 1) { + android_errorWriteLog(0x534e4554, "119870451"); + return; + } + if (p + cfg_len > p_next_cmd) { android_errorWriteLog(0x534e4554, "74202041"); return; } @@ -544,7 +564,11 @@ static void process_l2cap_cmd (tL2C_LCB *p_lcb, UINT8 *p, UINT16 pkt_len) case L2CAP_CFG_TYPE_EXT_FLOW: cfg_info.ext_flow_spec_present = TRUE; - if (p + 2 + 2 + 3 * 4 > p_next_cmd) { + if (cfg_len != 1 + 2 + 3 * 4) { + android_errorWriteLog(0x534e4554, "119870451"); + return; + } + if (p + cfg_len > p_next_cmd) { android_errorWriteLog(0x534e4554, "74202041"); return; } diff --git a/stack/l2cap/l2c_utils.c b/stack/l2cap/l2c_utils.c index 58ac4b06b..72bd52ed1 100644 --- a/stack/l2cap/l2c_utils.c +++ b/stack/l2cap/l2c_utils.c @@ -859,6 +859,9 @@ void l2cu_send_peer_config_rej (tL2C_CCB *p_ccb, UINT8 *p_data, UINT16 data_len, case L2CAP_CFG_TYPE_MTU: case L2CAP_CFG_TYPE_FLUSH_TOUT: case L2CAP_CFG_TYPE_QOS: + case L2CAP_CFG_TYPE_FCR: + case L2CAP_CFG_TYPE_FCS: + case L2CAP_CFG_TYPE_EXT_FLOW: p_data += cfg_len + L2CAP_CFG_OPTION_OVERHEAD; break; -- 2.11.0