From 7f436b9b065ad39a7b899766d3c3c3f52cbf1bbb Mon Sep 17 00:00:00 2001 From: Chienyuan Date: Thu, 29 Nov 2018 23:19:27 +0800 Subject: [PATCH] Fix OOB in smp_proc_pair_fail Bug: 111214739 Test: manual Change-Id: Ida9b2cad40a299bf2c9abdc4ddd6e12495391553 --- stack/smp/smp_act.cc | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/stack/smp/smp_act.cc b/stack/smp/smp_act.cc index 3fe90b547..cb0280c60 100644 --- a/stack/smp/smp_act.cc +++ b/stack/smp/smp_act.cc @@ -16,6 +16,7 @@ * ******************************************************************************/ +#include #include #include #include "btif_common.h" @@ -488,7 +489,15 @@ void smp_proc_sec_grant(tSMP_CB* p_cb, tSMP_INT_DATA* p_data) { ******************************************************************************/ void smp_proc_pair_fail(tSMP_CB* p_cb, tSMP_INT_DATA* p_data) { SMP_TRACE_DEBUG("%s", __func__); - p_cb->status = p_data->status; + + if (p_cb->rcvd_cmd_len < 2) { + android_errorWriteLog(0x534e4554, "111214739"); + SMP_TRACE_WARNING("%s: rcvd_cmd_len %d too short: must be at least 2", + __func__, p_cb->rcvd_cmd_len); + p_cb->status = SMP_INVALID_PARAMETERS; + } else { + p_cb->status = p_data->status; + } /* Cancel pending auth complete timer if set */ alarm_cancel(p_cb->delayed_auth_timer_ent); -- 2.11.0