From 4291c84baac0d18d2b855dc9df52768fc0367a7a Mon Sep 17 00:00:00 2001 From: Myles Watson Date: Wed, 24 Oct 2018 17:05:12 -0700 Subject: [PATCH] DO NOT MERGE: SDP: Check p_end in save_attr_seq and add_attr (This CL is missed between oc-dev and oc-mr1-dev) Bug: 115900043 Test: Sanity pairing and SDP PTS Change-Id: Ib642f79ed22b65ede5ff786cb1e163d172480f11 Merged-In: Ib642f79ed22b65ede5ff786cb1e163d172480f11 (cherry picked from commit d4f012bc80bc68be1cab967958d4cf7e9c1ee442) --- stack/sdp/sdp_discovery.cc | 34 ++++++++++++++++++++-------------- 1 file changed, 20 insertions(+), 14 deletions(-) diff --git a/stack/sdp/sdp_discovery.cc b/stack/sdp/sdp_discovery.cc index 339b07d0e..78b624274 100644 --- a/stack/sdp/sdp_discovery.cc +++ b/stack/sdp/sdp_discovery.cc @@ -52,7 +52,7 @@ static void process_service_search_attr_rsp(tCONN_CB* p_ccb, uint8_t* p_reply, uint8_t* p_reply_end); static uint8_t* save_attr_seq(tCONN_CB* p_ccb, uint8_t* p, uint8_t* p_msg_end); static tSDP_DISC_REC* add_record(tSDP_DISCOVERY_DB* p_db, BD_ADDR p_bda); -static uint8_t* add_attr(uint8_t* p, tSDP_DISCOVERY_DB* p_db, +static uint8_t* add_attr(uint8_t* p, uint8_t* p_end, tSDP_DISCOVERY_DB* p_db, tSDP_DISC_REC* p_rec, uint16_t attr_id, tSDP_DISC_ATTR* p_parent_attr, uint8_t nest_level); @@ -765,7 +765,7 @@ static uint8_t* save_attr_seq(tCONN_CB* p_ccb, uint8_t* p, uint8_t* p_msg_end) { BE_STREAM_TO_UINT16(attr_id, p); /* Now, add the attribute value */ - p = add_attr(p, p_ccb->p_db, p_rec, attr_id, NULL, 0); + p = add_attr(p, p_seq_end, p_ccb->p_db, p_rec, attr_id, NULL, 0); if (!p) { SDP_TRACE_WARNING("SDP - DB full add_attr"); @@ -825,7 +825,7 @@ tSDP_DISC_REC* add_record(tSDP_DISCOVERY_DB* p_db, BD_ADDR p_bda) { * Returns pointer to next byte in data stream * ******************************************************************************/ -static uint8_t* add_attr(uint8_t* p, tSDP_DISCOVERY_DB* p_db, +static uint8_t* add_attr(uint8_t* p, uint8_t* p_end, tSDP_DISCOVERY_DB* p_db, tSDP_DISC_REC* p_rec, uint16_t attr_id, tSDP_DISC_ATTR* p_parent_attr, uint8_t nest_level) { tSDP_DISC_ATTR* p_attr; @@ -834,7 +834,7 @@ static uint8_t* add_attr(uint8_t* p, tSDP_DISCOVERY_DB* p_db, uint16_t attr_type; uint16_t id; uint8_t type; - uint8_t* p_end; + uint8_t* p_attr_end; uint8_t is_additional_list = nest_level & SDP_ADDITIONAL_LIST_MASK; nest_level &= ~(SDP_ADDITIONAL_LIST_MASK); @@ -851,6 +851,13 @@ static uint8_t* add_attr(uint8_t* p, tSDP_DISCOVERY_DB* p_db, else total_len = sizeof(tSDP_DISC_ATTR); + p_attr_end = p + attr_len; + if (p_attr_end > p_end) { + android_errorWriteLog(0x534e4554, "115900043"); + SDP_TRACE_WARNING("%s: SDP - Attribute length beyond p_end", __func__); + return NULL; + } + /* Ensure it is a multiple of 4 */ total_len = (total_len + 3) & ~3; @@ -874,18 +881,17 @@ static uint8_t* add_attr(uint8_t* p, tSDP_DISCOVERY_DB* p_db, * sub-attributes */ p_db->p_free_mem += sizeof(tSDP_DISC_ATTR); p_db->mem_free -= sizeof(tSDP_DISC_ATTR); - p_end = p + attr_len; total_len = 0; /* SDP_TRACE_DEBUG ("SDP - attr nest level:%d(list)", nest_level); */ if (nest_level >= MAX_NEST_LEVELS) { SDP_TRACE_ERROR("SDP - attr nesting too deep"); - return (p_end); + return p_attr_end; } /* Now, add the list entry */ - p = add_attr(p, p_db, p_rec, ATTR_ID_PROTOCOL_DESC_LIST, p_attr, - (uint8_t)(nest_level + 1)); + p = add_attr(p, p_end, p_db, p_rec, ATTR_ID_PROTOCOL_DESC_LIST, + p_attr, (uint8_t)(nest_level + 1)); break; } @@ -944,7 +950,7 @@ static uint8_t* add_attr(uint8_t* p, tSDP_DISCOVERY_DB* p_db, break; default: SDP_TRACE_WARNING("SDP - bad len in UUID attr: %d", attr_len); - return (p + attr_len); + return p_attr_end; } break; @@ -954,22 +960,22 @@ static uint8_t* add_attr(uint8_t* p, tSDP_DISCOVERY_DB* p_db, * sub-attributes */ p_db->p_free_mem += sizeof(tSDP_DISC_ATTR); p_db->mem_free -= sizeof(tSDP_DISC_ATTR); - p_end = p + attr_len; total_len = 0; /* SDP_TRACE_DEBUG ("SDP - attr nest level:%d", nest_level); */ if (nest_level >= MAX_NEST_LEVELS) { SDP_TRACE_ERROR("SDP - attr nesting too deep"); - return (p_end); + return p_attr_end; } if (is_additional_list != 0 || attr_id == ATTR_ID_ADDITION_PROTO_DESC_LISTS) nest_level |= SDP_ADDITIONAL_LIST_MASK; /* SDP_TRACE_DEBUG ("SDP - attr nest level:0x%x(finish)", nest_level); */ - while (p < p_end) { + while (p < p_attr_end) { /* Now, add the list entry */ - p = add_attr(p, p_db, p_rec, 0, p_attr, (uint8_t)(nest_level + 1)); + p = add_attr(p, p_end, p_db, p_rec, 0, p_attr, + (uint8_t)(nest_level + 1)); if (!p) return (NULL); } @@ -987,7 +993,7 @@ static uint8_t* add_attr(uint8_t* p, tSDP_DISCOVERY_DB* p_db, break; default: SDP_TRACE_WARNING("SDP - bad len in boolean attr: %d", attr_len); - return (p + attr_len); + return p_attr_end; } break; -- 2.11.0