diff options
| author | Hui Peng <phui@google.com> | 2023-10-20 00:11:24 +0000 |
|---|---|---|
| committer | George Zacharia <george.zcharia@gmail.com> | 2024-03-09 15:19:56 +0530 |
| commit | 37dccaf032aa39554c766d5770b6625f56751f95 (patch) | |
| tree | 3e87189796b12bb6359153e57c6caefb550d3182 | |
| parent | f9c9eaa3caefd17dacf130b252285c43ee29e0c2 (diff) | |
Fix an OOB bug in smp_proc_sec_req
Bug: 300903400
Test: m com.android.btservices
Ignore-AOSP-First: security
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:f20a759c149b739f8dfc3790287ad1b954115c18)
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:a4704e7519d0a02c1caf8b4d8ed874bc201a4b91)
Merged-In: I400cfa3523c6d8b25c233205748c2db5dc803d1d
Change-Id: I400cfa3523c6d8b25c233205748c2db5dc803d1d
| -rw-r--r-- | system/stack/smp/smp_act.cc | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/system/stack/smp/smp_act.cc b/system/stack/smp/smp_act.cc index 3c8218e9fe..868c7b5311 100644 --- a/system/stack/smp/smp_act.cc +++ b/system/stack/smp/smp_act.cc @@ -436,6 +436,13 @@ void smp_send_ltk_reply(tSMP_CB* p_cb, tSMP_INT_DATA* p_data) { * Description process security request. ******************************************************************************/ void smp_proc_sec_req(tSMP_CB* p_cb, tSMP_INT_DATA* p_data) { + if (smp_command_has_invalid_length(p_cb)) { + tSMP_INT_DATA smp_int_data; + smp_int_data.status = SMP_INVALID_PARAMETERS; + smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &smp_int_data); + return; + } + tBTM_LE_AUTH_REQ auth_req = *(tBTM_LE_AUTH_REQ*)p_data->p_data; tBTM_BLE_SEC_REQ_ACT sec_req_act; |