commit 90107b765118dc9a5848ab2e41479473cc4b0979
author Jakub Pawlowski <jpawlowski@google.com> Fri Nov 20 17:44:50 2020 +0100
committer Jakub Pawlowski <jpawlowski@google.com> Thu Dec 03 11:48:45 2020 +0000
tree 897926e320a84f16ac16513147e2678f671b63a0
parent c4edc2575e8cdad93e528a1314e9a8d1bc46d55f

Check if advertiserId value matches valid advertiser

Passing non-existing advertiserId can result in OOB

Bug: 171400004
Merged-In: I4536abc50e15cfc72489e01f8907face967df263
Change-Id: I4536abc50e15cfc72489e01f8907face967df263

src/com/android/bluetooth/gatt/AdvertiseManager.java

diff --git a/src/com/android/bluetooth/gatt/AdvertiseManager.java b/src/com/android/bluetooth/gatt/AdvertiseManager.java
index f12cd89..f3ae59a 100644
--- a/src/com/android/bluetooth/gatt/AdvertiseManager.java
+++ b/src/com/android/bluetooth/gatt/AdvertiseManager.java
@@ -211,7 +211,7 @@
 
         Map.Entry<IBinder, AdvertiserInfo> entry = findAdvertiser(advertiser_id);
         if (entry == null) {
-            Log.i(TAG, "onOwnAddressRead() - bad advertiser_id " + advertiser_id);
+            Log.w(TAG, "onOwnAddressRead() - bad advertiser_id " + advertiser_id);
             return;
         }
 
@@ -220,6 +220,11 @@
     }
 
     void getOwnAddress(int advertiserId) {
+        Map.Entry<IBinder, AdvertiserInfo> entry = findAdvertiser(advertiserId);
+        if (entry == null) {
+            Log.w(TAG, "getOwnAddress() - bad advertiserId " + advertiserId);
+            return;
+        }
         getOwnAddressNative(advertiserId);
     }
 
@@ -252,37 +257,72 @@
     }
 
     void enableAdvertisingSet(int advertiserId, boolean enable, int duration, int maxExtAdvEvents) {
+        Map.Entry<IBinder, AdvertiserInfo> entry = findAdvertiser(advertiserId);
+        if (entry == null) {
+            Log.w(TAG, "enableAdvertisingSet() - bad advertiserId " + advertiserId);
+            return;
+        }
         enableAdvertisingSetNative(advertiserId, enable, duration, maxExtAdvEvents);
     }
 
     void setAdvertisingData(int advertiserId, AdvertiseData data) {
+        Map.Entry<IBinder, AdvertiserInfo> entry = findAdvertiser(advertiserId);
+        if (entry == null) {
+            Log.w(TAG, "setAdvertisingData() - bad advertiserId " + advertiserId);
+            return;
+        }
         String deviceName = AdapterService.getAdapterService().getName();
         setAdvertisingDataNative(
                 advertiserId, AdvertiseHelper.advertiseDataToBytes(data, deviceName));
     }
 
     void setScanResponseData(int advertiserId, AdvertiseData data) {
+        Map.Entry<IBinder, AdvertiserInfo> entry = findAdvertiser(advertiserId);
+        if (entry == null) {
+            Log.w(TAG, "setScanResponseData() - bad advertiserId " + advertiserId);
+            return;
+        }
         String deviceName = AdapterService.getAdapterService().getName();
         setScanResponseDataNative(
                 advertiserId, AdvertiseHelper.advertiseDataToBytes(data, deviceName));
     }
 
     void setAdvertisingParameters(int advertiserId, AdvertisingSetParameters parameters) {
+        Map.Entry<IBinder, AdvertiserInfo> entry = findAdvertiser(advertiserId);
+        if (entry == null) {
+            Log.w(TAG, "setAdvertisingParameters() - bad advertiserId " + advertiserId);
+            return;
+        }
         setAdvertisingParametersNative(advertiserId, parameters);
     }
 
     void setPeriodicAdvertisingParameters(
             int advertiserId, PeriodicAdvertisingParameters parameters) {
+        Map.Entry<IBinder, AdvertiserInfo> entry = findAdvertiser(advertiserId);
+        if (entry == null) {
+            Log.w(TAG, "setPeriodicAdvertisingParameters() - bad advertiserId " + advertiserId);
+            return;
+        }
         setPeriodicAdvertisingParametersNative(advertiserId, parameters);
     }
 
     void setPeriodicAdvertisingData(int advertiserId, AdvertiseData data) {
+        Map.Entry<IBinder, AdvertiserInfo> entry = findAdvertiser(advertiserId);
+        if (entry == null) {
+            Log.w(TAG, "setPeriodicAdvertisingData() - bad advertiserId " + advertiserId);
+            return;
+        }
         String deviceName = AdapterService.getAdapterService().getName();
         setPeriodicAdvertisingDataNative(
                 advertiserId, AdvertiseHelper.advertiseDataToBytes(data, deviceName));
     }
 
     void setPeriodicAdvertisingEnable(int advertiserId, boolean enable) {
+        Map.Entry<IBinder, AdvertiserInfo> entry = findAdvertiser(advertiserId);
+        if (entry == null) {
+            Log.w(TAG, "setPeriodicAdvertisingEnable() - bad advertiserId " + advertiserId);
+            return;
+        }
         setPeriodicAdvertisingEnableNative(advertiserId, enable);
     }