From ce8f2c0c3219bc5ade06b77eae715b1bf024a45a Mon Sep 17 00:00:00 2001
From: Martin Brabham <optedoblivion@google.com>
Date: Wed, 19 Aug 2020 23:03:03 -0700
Subject: [PATCH] Ensure IO Cap Response received before processing
 UserConfirmationRequest

Bug: 162984360
Tag: #gd-refactor
Test: cert/run --host SecurityTest
Change-Id: Iab245ff61b9a747b6a93336f7a75e2f3e4727054
---
 gd/security/pairing/classic_pairing_handler.cc | 10 ++++++++++
 gd/security/pairing/classic_pairing_handler.h  |  1 +
 2 files changed, 11 insertions(+)

diff --git a/gd/security/pairing/classic_pairing_handler.cc b/gd/security/pairing/classic_pairing_handler.cc
index 9267614fe..70dd574b3 100644
--- a/gd/security/pairing/classic_pairing_handler.cc
+++ b/gd/security/pairing/classic_pairing_handler.cc
@@ -199,6 +199,10 @@ void ClassicPairingHandler::OnReceive(hci::IoCapabilityResponseView packet) {
       break;
   }
   has_gotten_io_cap_response_ = true;
+  if (user_confirmation_request_) {
+    this->OnReceive(*user_confirmation_request_);
+    user_confirmation_request_ = std::nullopt;
+  }
 }
 
 void ClassicPairingHandler::OnReceive(hci::SimplePairingCompleteView packet) {
@@ -268,7 +272,13 @@ void ClassicPairingHandler::OnReceive(hci::KeypressNotificationView packet) {
  *
  * The table is on pg 2133 of the Core v5.1 spec.
  */
+
 void ClassicPairingHandler::OnReceive(hci::UserConfirmationRequestView packet) {
+  // Ensure we have io cap response otherwise checks will be wrong if it comes late
+  if (!has_gotten_io_cap_response_) {
+    user_confirmation_request_ = std::make_optional<hci::UserConfirmationRequestView>(packet);
+    return;
+  }
   ASSERT(packet.IsValid());
   LOG_INFO("Received: %s", hci::EventCodeText(packet.GetEventCode()).c_str());
   ASSERT_LOG(GetRecord()->GetPseudoAddress()->GetAddress() == packet.GetBdAddr(), "Address mismatch");
diff --git a/gd/security/pairing/classic_pairing_handler.h b/gd/security/pairing/classic_pairing_handler.h
index 4ba71b3d1..b3c4d0c69 100644
--- a/gd/security/pairing/classic_pairing_handler.h
+++ b/gd/security/pairing/classic_pairing_handler.h
@@ -99,6 +99,7 @@ class ClassicPairingHandler : public PairingHandler {
   bool is_cancelled_ = false;
 
   bool has_gotten_io_cap_response_ = false;
+  std::optional<hci::UserConfirmationRequestView> user_confirmation_request_ = std::nullopt;
 
   hci::ErrorCode last_status_ = hci::ErrorCode::UNKNOWN_HCI_COMMAND;
   bool locally_initiated_ = false;
-- 
2.11.0