diff options
| author | Brian Delwiche <delwiche@google.com> | 2024-05-16 20:47:44 +0000 |
|---|---|---|
| committer | aoleary <seanm187@gmail.com> | 2024-12-30 07:26:32 +0000 |
| commit | cba3f48e6ae81d9449db7a35eda0043be3f7b842 (patch) | |
| tree | 626a1c69b52b86801e793cd84cd80ef0b7f40ebe | |
| parent | 95a3ab9314f5d71fc75bd596e09996ac30ff679a (diff) | |
Fix OOB write in build_read_multi_rsp of gatt_sr.cc
build_read_multi_rsp is missing a bounds check, which can lead to an
OOB write when the mtu parameter is set to zero.
Add that bounds check.
Bug: 323850943
Test: atest GattSrTest
Test: researcher POC
Tag: #security
Flag: EXEMPT trivial validity checks
Ignore-AOSP-First: Security
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:cad927034a371b82a4a07a16ec442eb261f6153f)
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:e5ab6c617683a00c4e2996f1bc15c4c6e7f70f48)
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:269a60348a373fa5bb20098c45125223726f13ff)
Merged-In: I18e4325dbc9d6814220332288c85b114d0415c2f
Change-Id: I18e4325dbc9d6814220332288c85b114d0415c2f
| -rw-r--r-- | system/stack/eatt/eatt.h | 1 | ||||
| -rw-r--r-- | system/stack/gatt/gatt_sr.cc | 7 |
2 files changed, 8 insertions, 0 deletions
diff --git a/system/stack/eatt/eatt.h b/system/stack/eatt/eatt.h index 1310f65480..ed4f9d6bbf 100644 --- a/system/stack/eatt/eatt.h +++ b/system/stack/eatt/eatt.h @@ -99,6 +99,7 @@ class EattChannel { void EattChannelSetTxMTU(uint16_t tx_mtu) { this->tx_mtu_ = std::min<uint16_t>(tx_mtu, EATT_MAX_TX_MTU); + this->tx_mtu_ = std::max<uint16_t>(this->tx_mtu_, EATT_MIN_MTU_MPS); } }; diff --git a/system/stack/gatt/gatt_sr.cc b/system/stack/gatt/gatt_sr.cc index ce00ef7428..50967fa0f1 100644 --- a/system/stack/gatt/gatt_sr.cc +++ b/system/stack/gatt/gatt_sr.cc @@ -148,6 +148,13 @@ static void build_read_multi_rsp(tGATT_SR_CMD* p_cmd, uint16_t mtu) { uint8_t* p; bool is_overflow = false; + // We need at least one extra byte for the opcode + if (mtu == 0) { + LOG(ERROR) << "Invalid MTU"; + p_cmd->status = GATT_ILLEGAL_PARAMETER; + return; + } + len = sizeof(BT_HDR) + L2CAP_MIN_OFFSET + mtu; BT_HDR* p_buf = (BT_HDR*)osi_calloc(len); p_buf->offset = L2CAP_MIN_OFFSET; |