commit da3422f1987b791c841698098861f0af23136b7c
author Cheney Ni <cheneyni@google.com> Fri Aug 23 23:05:19 2019 +0800
committer Cheney Ni <cheneyni@google.com> Tue Aug 27 16:28:42 2019 +0800
tree 1b68317e9680742080775e83d3a1348503ca864c
parent 950c8a191e37b4307070613ee7f7c4d739bf9614

AdapterService: Check the PIN code length before using

The length is assigned by the framework. We should be better to check
again before using, and dropped any unexcepted input.

Bug: 139287605
Test: PoC
Change-Id: Ie2dd01e0b192e7ed1fe4b464618ddfa415dbf15c
Merged-In: Ie2dd01e0b192e7ed1fe4b464618ddfa415dbf15c

src/com/android/bluetooth/btservice/AdapterService.java

diff --git a/src/com/android/bluetooth/btservice/AdapterService.java b/src/com/android/bluetooth/btservice/AdapterService.java
index 3a14954..26e2fb2 100644
--- a/src/com/android/bluetooth/btservice/AdapterService.java
+++ b/src/com/android/bluetooth/btservice/AdapterService.java
@@ -1986,6 +1986,11 @@
             return false;
         }
 
+        if (pinCode.length != len) {
+            EventLog.writeEvent(0x534e4554, "139287605", -1, "PIN code length mismatch");
+            return false;
+        }
+
         byte[] addr = Utils.getBytesFromAddress(device.getAddress());
         return pinReplyNative(addr, accept, len, pinCode);
     }
@@ -1997,6 +2002,11 @@
             return false;
         }
 
+        if (passkey.length != len) {
+            EventLog.writeEvent(0x534e4554, "139287605", -1, "Passkey length mismatch");
+            return false;
+        }
+
         byte[] addr = Utils.getBytesFromAddress(device.getAddress());
         return sspReplyNative(addr, AbstractionLayer.BT_SSP_VARIANT_PASSKEY_ENTRY, accept,
                 Utils.byteArrayToInt(passkey));