smp: Reject pairing if the public keys match

Bug: 174886838
Test: pair an LE device
Tag: #security
Change-Id: I0902fdf6bb5c1c7d443fc73fc480d51226fb836b
Merged-In: I0902fdf6bb5c1c7d443fc73fc480d51226fb836b

diff --git a/stack/smp/smp_act.cc b/stack/smp/smp_act.cc
index 5b548b6..b7ba0d8 100644 (file)
--- a/stack/smp/smp_act.cc
+++ b/stack/smp/smp_act.cc
@@ -661,6 +661,15 @@ void smp_process_pairing_public_key(tSMP_CB* p_cb, tSMP_INT_DATA* p_data) {
   memcpy(pt.x, p_cb->peer_publ_key.x, BT_OCTET32_LEN);
   memcpy(pt.y, p_cb->peer_publ_key.y, BT_OCTET32_LEN);
 
+  if (!memcmp(p_cb->peer_publ_key.x, p_cb->loc_publ_key.x, BT_OCTET32_LEN) &&
+      !memcmp(p_cb->peer_publ_key.y, p_cb->loc_publ_key.y, BT_OCTET32_LEN)) {
+    android_errorWriteLog(0x534e4554, "174886838");
+    SMP_TRACE_WARNING("Remote and local public keys can't match");
+    reason = SMP_PAIR_AUTH_FAIL;
+    smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
+    return;
+  }
+
   if (!ECC_ValidatePoint(pt)) {
     android_errorWriteLog(0x534e4554, "72377774");
     smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);