commit 49acada519d088d8edf37e48640c76ea5c70e010
author Hansong Zhang <hsz@google.com> Tue May 29 17:38:39 2018 -0700
committer android-build-team Robot <android-build-team-robot@google.com> Fri Jul 20 00:20:16 2018 +0000
tree 369b86ed5eacd04b048a866b817874566e44513b
parent 51b05b715024adff4fa59ab2e18c0b56c5d3af5e

DO NOT MERGE SMP: Check p_cb->role in smp_br_state_machine_event

Bug: 80145946
Test: manual
Change-Id: Ic83eaa4be868d5a345d80cd50a6915c0af719a53
(cherry picked from commit 519b61392a96fbd45bdcc0bfddc881167c20cc23)

stack/smp/smp_br_main.cc

diff --git a/stack/smp/smp_br_main.cc b/stack/smp/smp_br_main.cc
index 260b9c4..55405cc 100644
--- a/stack/smp/smp_br_main.cc
+++ b/stack/smp/smp_br_main.cc
@@ -19,6 +19,7 @@
 #include "bt_target.h"
 
 #include <string.h>
+#include "log/log.h"
 #include "smp_int.h"
 
 const char* const smp_br_state_name[SMP_BR_STATE_MAX + 1] = {
@@ -308,6 +309,12 @@
     return;
   }
 
+  if (p_cb->role > HCI_ROLE_SLAVE) {
+    SMP_TRACE_ERROR("%s: invalid role %d", __func__, p_cb->role);
+    android_errorWriteLog(0x534e4554, "80145946");
+    return;
+  }
+
   SMP_TRACE_DEBUG("SMP Role: %s State: [%s (%d)], Event: [%s (%d)]",
                   (p_cb->role == HCI_ROLE_SLAVE) ? "Slave" : "Master",
                   smp_get_br_state_name(p_cb->br_state), p_cb->br_state,