mirror of
https://github.com/Divested-Mobile/DivestOS-Build.git
synced 2024-07-05 19:11:15 +00:00
082bc48c32
https://review.lineageos.org/q/topic:P_asb_2022-05 https://review.lineageos.org/q/topic:P_asb_2022-06 https://review.lineageos.org/q/topic:P_asb_2022-07 https://review.lineageos.org/q/topic:P_asb_2022-08 https://review.lineageos.org/q/topic:P_asb_2022-09 https://review.lineageos.org/q/topic:P_asb_2022-10 https://review.lineageos.org/q/topic:P_asb_2022-11 https://review.lineageos.org/q/topic:P_asb_2022-12 https://review.lineageos.org/q/topic:P_asb_2023-01 https://review.lineageos.org/q/topic:P_asb_2023-02 https://review.lineageos.org/q/topic:P_asb_2023-03 https://review.lineageos.org/q/topic:P_asb_2023-04 https://review.lineageos.org/q/topic:P_asb_2023-05 https://review.lineageos.org/q/topic:P_asb_2023-06 https://review.lineageos.org/q/topic:P_asb_2023-07 accounted for via manifest change: https://review.lineageos.org/c/LineageOS/android_external_freetype/+/361250 https://review.lineageos.org/q/topic:P_asb_2023-08 accounted for via manifest change: https://review.lineageos.org/c/LineageOS/android_external_freetype/+/364606 accounted for via patches: https://review.lineageos.org/c/LineageOS/android_system_ca-certificates/+/365328 https://review.lineageos.org/q/topic:P_asb_2023-09 https://review.lineageos.org/q/topic:P_asb_2023-10 https://review.lineageos.org/q/topic:P_asb_2023-11 accounted for via patches: https://review.lineageos.org/c/LineageOS/android_system_ca-certificates/+/374916 https://review.lineageos.org/q/topic:P_asb_2023-12 https://review.lineageos.org/q/topic:P_asb_2024-01 https://review.lineageos.org/q/topic:P_asb_2024-02 https://review.lineageos.org/q/topic:P_asb_2024-03 https://review.lineageos.org/q/topic:P_asb_2024-04 Signed-off-by: Tavi <tavi@divested.dev>
51 lines
1.9 KiB
Diff
51 lines
1.9 KiB
Diff
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
From: Chienyuan <chienyuanhuang@google.com>
|
|
Date: Wed, 30 Jan 2019 19:17:03 +0800
|
|
Subject: [PATCH] Fix OOB in BNEP_Write
|
|
|
|
Bug: 112050583
|
|
Test: PoC
|
|
Change-Id: I2ad3aceea38950b83f98819ede47538afb053ac0
|
|
(cherry picked from commit b31554e2a31534888c0eb593d915f735ce4670c7)
|
|
CRs-Fixed: 3155069
|
|
---
|
|
stack/bnep/bnep_api.cc | 13 +++++++++++--
|
|
1 file changed, 11 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/stack/bnep/bnep_api.cc b/stack/bnep/bnep_api.cc
|
|
index aaa97603f..56551d4e9 100644
|
|
--- a/stack/bnep/bnep_api.cc
|
|
+++ b/stack/bnep/bnep_api.cc
|
|
@@ -340,10 +340,15 @@ tBNEP_RESULT BNEP_WriteBuf(uint16_t handle, const RawAddress& p_dest_addr,
|
|
p_bcb = &(bnep_cb.bcb[handle - 1]);
|
|
/* Check MTU size */
|
|
if (p_buf->len > BNEP_MTU_SIZE) {
|
|
- BNEP_TRACE_ERROR("BNEP_Write() length %d exceeded MTU %d", p_buf->len,
|
|
+ BNEP_TRACE_ERROR("%s length %d exceeded MTU %d", __func__, p_buf->len,
|
|
BNEP_MTU_SIZE);
|
|
osi_free(p_buf);
|
|
return (BNEP_MTU_EXCEDED);
|
|
+ } else if (p_buf->len < 2) {
|
|
+ BNEP_TRACE_ERROR("%s length %d too short, must be at least 2", __func__,
|
|
+ p_buf->len);
|
|
+ osi_free(p_buf);
|
|
+ return BNEP_IGNORE_CMD;
|
|
}
|
|
|
|
/* Check if the packet should be filtered out */
|
|
@@ -442,9 +447,13 @@ tBNEP_RESULT BNEP_Write(uint16_t handle, const RawAddress& p_dest_addr,
|
|
|
|
/* Check MTU size. Consider the possibility of having extension headers */
|
|
if (len > BNEP_MTU_SIZE) {
|
|
- BNEP_TRACE_ERROR("BNEP_Write() length %d exceeded MTU %d", len,
|
|
+ BNEP_TRACE_ERROR("%s length %d exceeded MTU %d", __func__, len,
|
|
BNEP_MTU_SIZE);
|
|
return (BNEP_MTU_EXCEDED);
|
|
+ } else if (len < 2) {
|
|
+ BNEP_TRACE_ERROR("%s length %d too short, must be at least 2", __func__,
|
|
+ len);
|
|
+ return BNEP_IGNORE_CMD;
|
|
}
|
|
|
|
if ((!handle) || (handle > BNEP_MAX_CONNECTIONS)) return (BNEP_WRONG_HANDLE);
|