Google Git
Sign in
android / platform / system / bt / 4650d4d536be3978fdc436cee3833d443dff9dc7
commit4650d4d536be3978fdc436cee3833d443dff9dc7[log] [tgz]
authorMartin Brabham <optedoblivion@google.com>Mon Aug 30 15:23:04 2021 -0700
committerAndroid Build Coastguard Worker <android-build-coastguard-worker@google.com>Wed Sep 15 00:11:00 2021 +0000
tree7cf0125c93b41d7f237dddeb627dd8575318e459
parenta430f5183c9836302f19d793a13e3670b21cc489 [diff]
Security Fix: Crafted GATT request causes BT stack crash

A while loop and condition check for the value of a type to be 0
when in fact since the value.len is arbitrary it could make the
remaining length "less than 0" and since the type is unsigned it'll
never be "less than 0."

Use signed type for loop and conditional checking.

Additionally, make sure the value.len when used to read an array is not
more than the remaining length of the data.

Bug: 197536150
Test: poc application
Tag: #security
Change-Id: I20d66ddd1055577d7d39aba447233c19081bb789
(cherry picked from commit 1da56d1c815aa4854aa42f721732070333e5e924)
1 file changed
tree: 7cf0125c93b41d7f237dddeb627dd8575318e459
  1. apex/
  2. audio_a2dp_hw/
  3. audio_bluetooth_hw/
  4. audio_hal_interface/
  5. audio_hearing_aid_hw/
  6. binder/
  7. bta/
  8. btcore/
  9. btif/
  10. build/
  11. common/
  12. conf/
  13. device/
  14. doc/
  15. embdrv/
  16. gd/
  17. hci/
  18. include/
  19. internal_include/
  20. linux_include/
  21. main/
  22. osi/
  23. packet/
  24. profile/
  25. service/
  26. stack/
  27. test/
  28. tools/
  29. types/
  30. udrv/
  31. utils/
  32. vendor_libs/
  33. vnd/
  34. .clang-format
  35. .gitignore
  36. .style.yapf
  37. Android.bp
  38. AndroidTestTemplate.xml
  39. BUILD.gn
  40. build.py
  41. Cargo.toml
  42. CleanSpec.mk
  43. EventLogTags.logtags
  44. METADATA
  45. MODULE_LICENSE_APACHE2
  46. NOTICE
  47. OWNERS
  48. PREUPLOAD.cfg
  49. README.md
  50. rustfmt.toml
  51. TEST_MAPPING
README.md

Fluoride Bluetooth stack

Building and running on AOSP

Just build AOSP - Fluoride is there by default.

Building and running on Linux

Instructions for a Debian based distribution:

  • Debian Bullseye or newer
  • Ubuntu 20.10 or newer
  • Clang-11 or Clang-12
  • Flex 2.6.x
  • Bison 3.x.x (tested with 3.0.x, 3.2.x and 3.7.x)

You‘ll want to download some pre-requisite packages as well. If you’re currently configured for AOSP development, you should have all required packages. Otherwise, you can use the following apt-get list:

sudo apt-get install repo git-core gnupg flex bison gperf build-essential \
  zip curl zlib1g-dev gcc-multilib g++-multilib \
  x11proto-core-dev libx11-dev lib32z-dev libncurses5 \
  libgl1-mesa-dev libxml2-utils xsltproc unzip liblz4-tool libssl-dev \
  libc++-dev libevent-dev \
  flatbuffers-compiler libflatbuffers1 \
  openssl openssl-dev

You will also need a recent-ish version of Rust and Cargo. Please follow the instructions on Rustup to install a recent version.

Download source

mkdir ~/fluoride
cd ~/fluoride
git clone https://android.googlesource.com/platform/system/bt

Install dependencies (require sudo access). This adds some Ubuntu dependencies and also installs GN (which is the build tool we're using).

cd ~/fluoride/bt
build/install_deps.sh

The following third-party dependencies are necessary but currently unavailable via a package manager. You may have to build these from source and install them to your local environment.

  • libchrome
  • modp_b64

We provide a script to produce debian packages for those components, please follow the instructions in build/dpkg/README.txt.

The googletest packages provided by Debian/Ubuntu (libgmock-dev and libgtest-dev) do not provide pkg-config files, so you can build your own googletest using the steps below:

$ git clone https://github.com/google/googletest.git -b release-1.10.0
$ cd googletest        # Main directory of the cloned repository.
$ mkdir build          # Create a directory to hold the build output.
$ cd build
$ cmake ..             # Generate native build scripts for GoogleTest.
$ sudo make install -DCMAKE_INSTALL_PREFIX=/usr

Stage your build environment

For host build, we depend on a few other repositories:

Clone these all somewhere and create your staging environment.

export STAGING_DIR=path/to/your/staging/dir
mkdir ${STAGING_DIR}
mkdir -p ${STAGING_DIR}/external
ln -s $(readlink -f ${PLATFORM2_DIR}/common-mk) ${STAGING_DIR}/common-mk
ln -s $(readlink -f ${PLATFORM2_DIR}/.gn) ${STAGING_DIR}/.gn
ln -s $(readlink -f ${RUST_CRATE_DIR}) ${STAGING_DIR}/external/rust
ln -s $(readlink -f ${PROTO_LOG_DIR}) ${STAGING_DIR}/external/proto_logging

Build

We provide a build script to automate building assuming you've staged your build environment already as above.

./build.py --output ${OUTPUT_DIR} --platform-dir ${STAGING_DIR} --clang

This will build all targets to the output directory you've given. You can also build each stage separately (if you want to iterate on something specific):

  • prepare - Generate the GN rules
  • tools - Generate host tools
  • rust - Build the rust portion of the build
  • main - Build all the C/C++ code
  • test - Build all targets and run the tests
  • clean - Clean the output directory

You can choose to run only a specific stage by passing an arg via --target.

Currently, Rust builds are a separate stage that uses Cargo to build. See gd/rust/README.md for more information.

Run

By default on Linux, we statically link libbluetooth so you can just run the binary directly:

cd ~/fluoride/bt/out/Default
./bluetoothtbd -create-ipc-socket=fluoride