commit bb48be17568805b93be7842e3e019e01062713b6
author Brian Delwiche <delwiche@google.com> Wed Aug 10 06:47:52 2022 +0000
committer Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Wed Sep 14 17:52:59 2022 +0000
tree d59169e0d3c9974aeca4b62241e686cd5296a856
parent 83d9a99f1d469878bba45d5b1fad7174311f6cdd

Add buffer in pin_reply in bluetooth.cc

Bug: 228602963
Test: make
Tag: #security
Ignore-AOSP-First: Security
Change-Id: Ibd7d9041e528262537d175d0faa6d2ed16e7dceb
(cherry picked from commit 2c09d202c83af6a511ad29ead37f4055760f095f)
Merged-In: Ibd7d9041e528262537d175d0faa6d2ed16e7dceb

system/btif/src/bluetooth.cc

diff --git a/system/btif/src/bluetooth.cc b/system/btif/src/bluetooth.cc
index a251067..2be88b2 100644
--- a/system/btif/src/bluetooth.cc
+++ b/system/btif/src/bluetooth.cc
@@ -398,11 +398,14 @@
 
 static int pin_reply(const RawAddress* bd_addr, uint8_t accept, uint8_t pin_len,
                      bt_pin_code_t* pin_code) {
+  bt_pin_code_t tmp_pin_code;
   if (!interface_ready()) return BT_STATUS_NOT_READY;
   if (pin_code == nullptr || pin_len > PIN_CODE_LEN) return BT_STATUS_FAIL;
 
+  memcpy(&tmp_pin_code, pin_code, pin_len);
+
   do_in_main_thread(FROM_HERE, base::BindOnce(btif_dm_pin_reply, *bd_addr,
-                                              accept, pin_len, *pin_code));
+                                              accept, pin_len, tmp_pin_code));
   return BT_STATUS_SUCCESS;
 }