| Commit message (Collapse) | Author | Age | Files | Lines |
| |
|
|
|
|
|
|
|
|
|
| |
Bug: 174150451
Test: compilation
Tag: #security
Change-Id: I7a30edacf8377a9feecbb988b099d60d69b46f87
(cherry picked from commit 1f169323d335ab0dc260952c2dd3821144448b11)
Merged-In: I7a30edacf8377a9feecbb988b099d60d69b46f87
(cherry picked from commit 8d461a866a12cd3d7d6d68551a5d2a7139fab2b9)
(cherry picked from commit 41584e84a3288d4dc9770773fa3db81df209ae4c)
|
| |
|
|
|
|
|
|
|
| |
Bug: 174149901
Change-Id: Iefa41749ebbacd34afaa24131de7ee25d706e23f
Tag: Security
Test: POC
(cherry picked from commit 960c3f3c9a1f912544b92b7a744e22069a0bc27e)
(cherry picked from commit 0f447e4fffc45b10d29e1cfcc2eb66067abaf034)
|
| |
|
|
|
|
|
|
| |
Change-Id: If3daec91c3d108a4e7e988608e0600c79ea5f053
Tag: #vulnerability
Test: manual
Bug: 174626251
(cherry picked from commit 374bb0401a5649af4a97e8d8c7373c7daf37f6ac)
|
| |
|
|
|
|
|
|
|
|
| |
Bug: 174052148
Test: pair with headphones
Tag: #security
Change-Id: I1d014a7b793bb1b66e26652f6696499ea36a6510
(cherry picked from commit cfa5a74ea90a09e1c7413a25f04332ee2d1e3f21)
Merged-In: I1d014a7b793bb1b66e26652f6696499ea36a6510
(cherry picked from commit f0994f6e4723eddaa617b68139f064d945d9389e)
|
| |
|
|
|
|
|
|
|
| |
Bug: 169327567
Test: compiles
Tag: #security
Change-Id: Id4231fd7a142d630a2ada0f41a90e01afc011045
Merged-In: Id4231fd7a142d630a2ada0f41a90e01afc011045
(cherry picked from commit 83c32e8e8c0c27333779c64b74473cad86670265)
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
Check event id if of register notification command from remote to avoid
OOB write.
Tag: #security
Bug: 168802990
Test: atest net_test_btif
Change-Id: I90834b920d61bfb2df9414a25d73ba40033e4748
Merged-In: I90834b920d61bfb2df9414a25d73ba40033e4748
(cherry picked from commit 26d2f1d06ad2641c0e70193176843e610fce07c0)
|
| |
|
|
|
|
|
| |
Bug: 169342531
Test: POC
Change-Id: I0e8cdb9a00184f62d11fb06bc30f07b2a35bc49e
(cherry picked from commit d7573f4fa9007ab7750edfc56305eea97c525cdb)
|
| |
|
|
|
|
|
|
|
|
| |
Bug: 158854097
Test: atest net_test_stack_smp
Tag: #security
Ignore-AOSP-First: Security fix
Change-Id: Id88241324e9fb89ef14e50b52eb459a0d81c492b
(cherry picked from commit d3521aa04a3c588cf581c903ea8b9301ae62e3c0)
|
| |
|
|
|
|
|
|
|
| |
Tag: #feature
Bug: 157038281
Test: Manual
Merged-In: Iadeb25a43b46f615b55a0dfb6e7723e5d1204351
Change-Id: Iadeb25a43b46f615b55a0dfb6e7723e5d1204351
(cherry picked from commit e45cec1547ec05bfcfb4fcf38da380c3eca77532)
|
| |
|
|
|
|
|
|
|
|
|
| |
Return directly after calling bta_dm_remove_device to
prevent from accessing the invalid security record (p_dev_rec).
Test: Hardcode to test bond with sample key
Tag: #security
Bug: 162497143
Change-Id: Iaa59f3c415dd8066849fd70912fdb83f890229d7
(cherry picked from commit 7c86810c44ef2efd97c3e78bd77e36257a05f75b)
|
| |
|
|
|
|
|
|
|
|
|
| |
the consent dialog for BLE pairing in JUSTWORKS and ENCRYPTION_ONLY mode
Tag: #feature
Bug: 157038281
Test: Manual
Merged-In: I6d06f5996da71e5a1407e544b0023d82924aa56f
Change-Id: I6d06f5996da71e5a1407e544b0023d82924aa56f
(cherry picked from commit cd3398b4e26f25cc6fe4d6928b258f76203de502)
|
| |
|
|
|
|
|
|
|
|
|
| |
energy device if the local device has a display.
Tag: #security
Bug: 157038281
Test: Manual
Merged-In: I7de396230beb84bd0fa2b0cea346523b6824472a
Change-Id: I7de396230beb84bd0fa2b0cea346523b6824472a
(cherry picked from commit b6bcc43c7b43f27f62a4c8ea0c15eead822b382a)
|
| |\
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
https://android.googlesource.com/platform/system/bt into q10.0
Android 10.0.0 release 46
* tag 'android-10.0.0_r46' of https://android.googlesource.com/platform/system/bt: (22 commits)
Fix possible OOB when receive gatt read type response data
Remove pairing on incoming bond request
Enable bitpool sanity checks
Check a2dp packet length is zero
Fix potential stack overflow caused by integer overflow
GattServcer: Check invalid offset
AAC Decoder: Use osi_free() to free buffers allocated by osi_malloc()
SDP: add return after SDP disconnection
Fix potential OOB write in btm_read_remote_ext_features_complete
GAP: Correct the continuous pkt length in l2cap
[system][bt] fix -Wdangling-gsl
Fix read out of bounds in BtifAvEvent::DeepCopy
JustWorks: Auto-accept only incoming temporary pairing.
SDP: Disconnect when there is a bad length
Use memcpy instead of casting to convert device_class to int
SDP: disconnect if sdp_copy_raw_data fails
Store BLE keys using the address from the ble_auth_cmpl_evt
Revert "libprocessgroup users use libcutils"
Reland Start the media encoder for a successful BTA_AV_START_EVT
Reland BluetoothAudio HAL: flip to be enabled by default
...
Change-Id: I2ff32562f7e66ed651bae41245035d0a960c5157
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Bug: 158833854
Bug: 158778659
Test: manual
Tag: #security
Change-Id: I1bd8713eecebc2bc3d919402b035987e06a2d4d3
(cherry picked from commit 0eb7a763dff47d349b5cfc5821116ece5a46ffa3)
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Bug: 150156492
Tag: #security
Test: Bond two devices, forget from one device and reconnect
Change-Id: I048b7b142e3fe2096cf1a9aa2931c175fa52cd45
Merged-In: I048b7b142e3fe2096cf1a9aa2931c175fa52cd45
(cherry picked from commit 13f409ad3a2423b06af7a7f1a9b06fb06c8820a7)
(cherry picked from commit 21e580de3b49668ab21a6e25cc8e5c81f203ee5e)
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Enable bitpool sanity checks to run all the time, not just in debug
mode.
Tag: #security
Test: sbcdecoder_fuzzer
Bug: 146398979
Change-Id: Iff58305cd18de35e37290f0c09fba01ee14e787a
(cherry picked from commit 59c234a8fddda37147bb3fe1dd3b3a668828bcab)
|
| | |
| |
| |
| |
| |
| |
| |
| |
| | |
Bug: 142546668
Test: net_test_stack_a2dp_native
Change-Id: I105b445293c02cb4f37c759fd5b05758fd4e3646
Merged-In: I105b445293c02cb4f37c759fd5b05758fd4e3646
(cherry picked from commit 96392b0f2cfb2adc72cc7cad0d74dec8f4041582)
|
| | |
| |
| |
| |
| |
| |
| | |
Bug: 151155194
Merged-In: I0655b0b62301f78cd8705cc7b0e4fc11522f00ca
Change-Id: I0655b0b62301f78cd8705cc7b0e4fc11522f00ca
(cherry picked from commit ec0d507ed24e513ae10f4f384e052a42cc964c56)
|
| | |
| |
| |
| |
| |
| |
| |
| | |
Test: manual
Bug: 143231677
Change-Id: I97e2c3ae15fccc482d07d8d621c455cc74900cfd
Merged-In: I0ca22e7c60292d61c758120c1cd67f6e6edd8ae8
(cherry picked from commit 7674de8fc890572471831ded8c80d3b52db5b60a)
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
* buffers allocated by osi_malloc() have canary bytes around it and need special method
osi_free() to free them
Bug: 148107188
Test: manual
Change-Id: Ifcfe494737c47e33755297214d3f637852a8be0b
(cherry picked from commit b88f8057fd28ca271ccd436a17f6489d4cf46697)
(cherry picked from commit 7a6fd5459ef8c6a2c21774e1220deb1023ae2935)
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
A return is needed after sdp_disconnect(). It is the logic
expected and it prevents the use of p_ccb after it's freed.
Bug: 144177780
Bug: 117105007
Test: manual test
Change-Id: I7a64382b36adca37a8ff0c7e361d89ecdc8f3b55
(cherry picked from commit 30efc8c90a846460359a489e17e1461c725958b3)
(cherry picked from commit 5edd605227af9a1b9eedf4fd9f02373a47fd49fb)
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Add event length check to avoid hci event sent from controller not
correct.
Add page number check to avoid page number is bigger than
HCI_EXT_FEATURES_PAGE_MAX.
Bug: 141552859
Bug: 144205318
Test: inject function
Merged-In: Iaca4db4ee9bf27362f62aba0da088727e98955d1
Change-Id: Iaca4db4ee9bf27362f62aba0da088727e98955d1
(cherry picked from commit 291307f66cc453ed6bc1ca7f16060a815cf64bfe)
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
L2cap continuous pkt length wrongly calculated in
reassembly logic when remote sends more data
than expected.
Wrong pkt length leading to memory corruption
Hence the Correct the continuous pkt length in
l2cap reassembly logic.
Bug: 135239489
Bug: 143894715
CRs-Fixed: 2434229
Test: make and internal testing
Change-Id: I758d9e31465b99e436b9b1841320000f08186c97
Merged-In: I758d9e31465b99e436b9b1841320000f08186c97
(cherry picked from commit 337bd4579453bd6bf98ff519de3ac1019cd30d28)
(cherry picked from commit 602f4b44fe30ec8b225e1cee5f96817607d93e5a)
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
BtAddrString() returns a std::string. It's not safe to chain a call to
c_str() as otherwise the returned std::string is a temporary, and the
expression evaluates to an immediately dangling pointer.
Bug: 139945549
Bug: 142558228
Test: mm
Change-Id: I30972458abcc563b24ee0d80b289c3efd6c3e04d
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
(cherry picked from commit 20ed45d6339079645ef9fe576b894e9497684c93)
|
| | |
| |
| |
| |
| |
| | |
Bug: 140768453
Change-Id: Ia05e12382ef78a3e07228d09bcf9347f9976bffd
(cherry picked from commit 8ac773aa5b2ace322a52e27a2231ac63688219de)
|
| | |
| |
| |
| |
| |
| |
| |
| |
| | |
Bug: 110433804
Bug: 134461862
Test: Manual; atest net_test_bluetooth
Change-Id: I4e3f39bc08e9d9493734a21ea29d76e43aeb50c8
Merged-In: I4e3f39bc08e9d9493734a21ea29d76e43aeb50c8
(cherry picked from commit a73dfccf325aa6e2bca86dffa9f203196d3fa4cc)
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Handle the case when SDP_RAW_DATA_INCLUDED is FALSE.
Related to: I9f0df8b2de28970e7d69b737ce5d363785183bf3
Bug: 137239831
Bug: 117105007
Test: manual test
Change-Id: I354494565005f2ca9093486546fc54c145066413
Merged-In: I354494565005f2ca9093486546fc54c145066413
(cherry picked from commit e45fe0a8ec678c73c57967b69c2fd485eef92927)
(cherry picked from commit 7f555a1a9b641a8e4892a4e7a7cc1ff294d8f2b7)
|
| | |
| |
| |
| |
| |
| |
| |
| |
| | |
Bug: 140152619
Test: atest net_test_btcoreclear
Change-Id: Iee71ce35576e438317841d41a81fda6a87e1984a
Merged-In: Iee71ce35576e438317841d41a81fda6a87e1984a
(cherry picked from commit ec75f1efb6b9be4933225a4b724e7a3ef5e3d70b)
(cherry picked from commit 50bf4cf1bf756a75bfd9672946561d9c5b647b7e)
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Our partners met with the problem with sdp_copy_raw_data updated in
CVE-2019-2116. When peer device responds with a wrong size,
sdp_copy_raw_data will not complete and won't trigger
disconnection. This CL enables the disconnection when a wrong size is
received.
Bug: 137239831
Bug: 117105007
Test: manual test
Change-Id: I9f0df8b2de28970e7d69b737ce5d363785183bf3
Merged-In: I9f0df8b2de28970e7d69b737ce5d363785183bf3
(cherry picked from commit bc9df3451dad17c1ab1002fdbc85d60e57d4f0af)
(cherry picked from commit 41939a2b5a8e3584c5a99dfe264a47df79e3091f)
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Reading the peer address from btif_dm_ble_auth_cmpl_evt, instead
of using the value from the pairing control block in
btif_dm_save_ble_bonding_keys, ensures that BLE keys are stored with
the correct address.
Bug: 133234174
Bug: 79703832
Test: 1. Initiate crosskey pairing from BLE
2. Check whether BLE keys are stored correctly
Change-Id: I18b4a1d8e2cdcd6dd4a300f1dc9e6d3892a3baff
Merged-In: I18b4a1d8e2cdcd6dd4a300f1dc9e6d3892a3baff
(cherry picked from commit 22711f1a45e141049c1c06d3f29015e4b03e1aa3)
|
| | |\
| | |
| | |
| | | |
Change-Id: Iac2701bc53447a9da66c74ac7303dfa3204a87d7
|
| | |\ \
| | | |
| | | |
| | | | |
Change-Id: I348cdbc2697d4a7906eaac96a67062ff12424847
|
| | |\ \ \
| | | | |
| | | | |
| | | | | |
Change-Id: I3a3fa9bd24e6e7241ee197a5578a6a59d512b786
|
| | |\ \ \ \
| | | | | |
| | | | | |
| | | | | | |
Change-Id: I2563419552856ab8ad82f50fc5436e18a527a2d3
|
| | |\ \ \ \ \
| | | | | | |
| | | | | | |
| | | | | | | |
Change-Id: I7c7b812798db7d9bab0de9a187dff2da1a88a9c8
|
| | |\ \ \ \ \ \
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | | |
8059012] into qt-release
Change-Id: I507c6bd7e5ac3a6525bd932a70824f2b474fd0f5
|
| | |/ / / / / /
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | | |
This reverts commit 93e1622ba65005d5611fc315503e4ed2f8a09658.
Reason for revert: breaks all camera use cases
Bug: 135568875
Exempt-From-Owner-Approval: revert, no build cop
Change-Id: I0b75d516e10a3432c71efd70ff100bf51e0e6d43
(cherry picked from commit 0c4d5997a4ae602b636e22156e1cc7957125fddf)
|
| | |\ \ \ \ \ \
| | | | | | | |
| | | | | | | |
| | | | | | | | |
Change-Id: I2d476074d6ffd2b7c7ab9c2ce4a05f2cf8d646a2
|
| | |\ \ \ \ \ \ \
| | | | | | | | |
| | | | | | | | |
| | | | | | | | | |
Change-Id: I6e4c5fcaffae31344401864cef4a32b1ded9e0cc
|
| | |\ \ \ \ \ \ \ \
| | | | | | | | | |
| | | | | | | | | |
| | | | | | | | | | |
Change-Id: Icf8c2ce6c35ae709ea11fb0d73b5b09d264fdd39
|
| | |\ \ \ \ \ \ \ \ \
| | | | | | | | | | |
| | | | | | | | | | |
| | | | | | | | | | | |
qt-release" into qt-release
|
| | | |\ \ \ \ \ \ \ \ \
| | | | | | | | | | | |
| | | | | | | | | | | |
| | | | | | | | | | | | |
Change-Id: Id0eec783cacb5c1e11c7926711db64dab1aedcde
|
| | |\ \ \ \ \ \ \ \ \ \ \
| | |/ / / / / / / / / /
| |/| / / / / / / / / /
| | |/ / / / / / / / / |
Change-Id: Ib05e5632e1fa99a9940c70193be9d72507ecd075
|
| | |\ \ \ \ \ \ \ \ \ \
| | | | | | | | | | | |
| | | | | | | | | | | |
| | | | | | | | | | | | |
Change-Id: I12e633146e0c692695b541fbe81c4d3323d9e8f8
|
| | |\ \ \ \ \ \ \ \ \ \ \
| | | | | | | | | | | | |
| | | | | | | | | | | | |
| | | | | | | | | | | | | |
Change-Id: I527797ec483bf1c80e7e6ae6c806eac62726ae59
|
| | |\ \ \ \ \ \ \ \ \ \ \ \
| | | | | | | | | | | | | |
| | | | | | | | | | | | | |
| | | | | | | | | | | | | | |
Change-Id: Icb69309b12f93c8772fcf2bfda248f64857540eb
|
| | |\ \ \ \ \ \ \ \ \ \ \ \ \
| | | | | | | | | | | | | | |
| | | | | | | | | | | | | | |
| | | | | | | | | | | | | | | |
Change-Id: I2e3c7301fd051c65aed34ba307f7f8fd893f0af7
|
| | |\ \ \ \ \ \ \ \ \ \ \ \ \ \
| | | | | | | | | | | | | | | |
| | | | | | | | | | | | | | | |
| | | | | | | | | | | | | | | | |
Change-Id: I2d78fcab432dc34cb37b11de7444cdbb5cf42d28
|
| | |\ \ \ \ \ \ \ \ \ \ \ \ \ \ \
| | | | | | | | | | | | | | | | |
| | | | | | | | | | | | | | | | |
| | | | | | | | | | | | | | | | | |
Change-Id: I9564256ed1409b57d66cf9cd378c8fe1684563f6
|
| | |\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \
| | | | | | | | | | | | | | | | | |
| | | | | | | | | | | | | | | | | |
| | | | | | | | | | | | | | | | | | |
Change-Id: I6181087c14b516a65721cd2439a2517b5cb6ebca
|