Git-Mirrors/DivestOS
1
0
Fork 0
mirror of https://github.com/Divested-Mobile/DivestOS-Build.git synced 2025-08-02 11:26:21 -04:00
Code Issues Projects Releases Packages Wiki Activity

Pull in old cherrypicks + 5 missing patches from syphyr

Browse source 
This adds 3 expat patches for n-asb-2022-09
from https://github.com/syphyr/android_external_expat/commits/cm-14.1
and also applies 2 of them to 15.1

Signed-off-by: Tad <tad@spotco.us>
This commit is contained in:
Tad 2022-09-11 12:25:11 -04:00
parent df3db92d5a
commit 202033c013
No known key found for this signature in database
GPG key ID: B286E9F57A07424B
89 changed files with 7138 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

119
Patches/LineageOS-14.1/android_system_bt/337999.patch Normal file
View file

@ -0,0 +1,119 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Chienyuan <chienyuanhuang@google.com>
Date: Tue, 12 Feb 2019 16:01:00 +0800
Subject: [PATCH] Fix OOB in bnep_is_packet_allowed
Bug: 112050983
Test: PoC
Change-Id: I5d331f46cdba86c8e61de206a2ede1d2b348d7e4
(cherry picked from commit 230f252b8a1a1073ec1a4081545b2ff62393d16d)
CRs-Fixed: 3155069
---
stack/bnep/bnep_api.c | 15 +++++++++++++--
stack/bnep/bnep_int.h | 2 +-
stack/bnep/bnep_utils.c | 13 ++++++++++++-
3 files changed, 26 insertions(+), 4 deletions(-)
diff --git a/stack/bnep/bnep_api.c b/stack/bnep/bnep_api.c
index dc349299a..e1c9f2e3d 100644
--- a/stack/bnep/bnep_api.c
+++ b/stack/bnep/bnep_api.c
@@ -387,7 +387,8 @@ tBNEP_RESULT BNEP_WriteBuf (UINT16 handle,
/* Check if the packet should be filtered out */
p_data = (UINT8 *)(p_buf + 1) + p_buf->offset;
- if (bnep_is_packet_allowed (p_bcb, p_dest_addr, protocol, fw_ext_present, p_data) != BNEP_SUCCESS)
+ if (bnep_is_packet_allowed (p_bcb, p_dest_addr, protocol, fw_ext_present,
+ p_data, p_buf->len) != BNEP_SUCCESS)
{
/*
** If packet is filtered and ext headers are present
@@ -401,6 +402,11 @@ tBNEP_RESULT BNEP_WriteBuf (UINT16 handle,
org_len = p_buf->len;
new_len = 0;
do {
+ if ((new_len + 2) > org_len)
+ {
+ osi_free(p_buf);
+ return BNEP_IGNORE_CMD;
+ }
ext = *p_data++;
length = *p_data++;
@@ -505,7 +511,8 @@ tBNEP_RESULT BNEP_Write (UINT16 handle,
p_bcb = &(bnep_cb.bcb[handle - 1]);
/* Check if the packet should be filtered out */
- if (bnep_is_packet_allowed (p_bcb, p_dest_addr, protocol, fw_ext_present, p_data) != BNEP_SUCCESS)
+ if (bnep_is_packet_allowed (p_bcb, p_dest_addr, protocol, fw_ext_present,
+ p_data, len) != BNEP_SUCCESS)
{
/*
** If packet is filtered and ext headers are present
@@ -520,6 +527,10 @@ tBNEP_RESULT BNEP_Write (UINT16 handle,
new_len = 0;
p = p_data;
do {
+ if ((new_len + 2) > org_len)
+ {
+ return BNEP_IGNORE_CMD;
+ }
ext = *p_data++;
length = *p_data++;
diff --git a/stack/bnep/bnep_int.h b/stack/bnep/bnep_int.h
index 126be04fe..b10098122 100644
--- a/stack/bnep/bnep_int.h
+++ b/stack/bnep/bnep_int.h
@@ -236,7 +236,7 @@ extern UINT8 *bnep_process_control_packet (tBNEP_CONN *p_bcb, UINT8 *p, UI
extern void bnep_sec_check_complete (BD_ADDR bd_addr, tBT_TRANSPORT trasnport,
void *p_ref_data, UINT8 result);
extern tBNEP_RESULT bnep_is_packet_allowed (tBNEP_CONN *p_bcb, BD_ADDR p_dest_addr, UINT16 protocol,
- BOOLEAN fw_ext_present, UINT8 *p_data);
+ BOOLEAN fw_ext_present, UINT8 *p_data, UINT16 org_len);
extern UINT32 bnep_get_uuid32 (tBT_UUID *src_uuid);
diff --git a/stack/bnep/bnep_utils.c b/stack/bnep/bnep_utils.c
index 65acd33f6..09f2d13c2 100644
--- a/stack/bnep/bnep_utils.c
+++ b/stack/bnep/bnep_utils.c
@@ -1336,7 +1336,7 @@ tBNEP_RESULT bnep_is_packet_allowed (tBNEP_CONN *p_bcb,
BD_ADDR p_dest_addr,
UINT16 protocol,
BOOLEAN fw_ext_present,
- UINT8 *p_data)
+ UINT8 *p_data, UINT16 org_len)
{
if (p_bcb->rcvd_num_filters)
{
@@ -1346,18 +1346,29 @@ tBNEP_RESULT bnep_is_packet_allowed (tBNEP_CONN *p_bcb,
proto = protocol;
if (proto == BNEP_802_1_P_PROTOCOL)
{
+ UINT16 new_len = 0;
if (fw_ext_present)
{
UINT8 len, ext;
/* parse the extension headers and findout actual protocol */
do {
+ if ((new_len + 2) > org_len)
+ {
+ return BNEP_IGNORE_CMD;
+ }
ext = *p_data++;
len = *p_data++;
p_data += len;
+ new_len += (len + 2);
+
} while (ext & 0x80);
}
+ if ((new_len + 4) > org_len)
+ {
+ return BNEP_IGNORE_CMD;
+ }
p_data += 2;
BE_STREAM_TO_UINT16 (proto, p_data);
}