commit 5a827a3b55c3b97e4e1e6896e9578ff18e4e7232
author weichinweng <weichinweng@google.com> Tue Jul 28 16:56:33 2020 +0800
committer Anis Assi <anisassi@google.com> Thu Aug 20 14:11:15 2020 -0700
tree 2cf16cb43f8d4c62a7f590473d2e6760f0213569
parent df2c79ef09127505db05baf3cbeec92ecf709255

Fix possible OOB when receive gatt read type response data

Bug: 158833854
Bug: 158778659
Test: manual
Tag: #security

Change-Id: I1bd8713eecebc2bc3d919402b035987e06a2d4d3
(cherry picked from commit 0eb7a763dff47d349b5cfc5821116ece5a46ffa3)

stack/gatt/gatt_cl.cc

diff --git a/stack/gatt/gatt_cl.cc b/stack/gatt/gatt_cl.cc
index dca4973..46572dd 100644
--- a/stack/gatt/gatt_cl.cc
+++ b/stack/gatt/gatt_cl.cc
@@ -768,6 +768,12 @@
     /* discover included service */
     else if (p_clcb->operation == GATTC_OPTYPE_DISCOVERY &&
              p_clcb->op_subtype == GATT_DISC_INC_SRVC) {
+      if (value_len < 4) {
+        android_errorWriteLog(0x534e4554, "158833854");
+        LOG(ERROR) << __func__ << " Illegal Response length, must be at least 4.";
+        gatt_end_operation(p_clcb, GATT_INVALID_PDU, NULL);
+        return;
+      }
       STREAM_TO_UINT16(record_value.incl_service.s_handle, p);
       STREAM_TO_UINT16(record_value.incl_service.e_handle, p);
 
@@ -821,6 +827,12 @@
       return;
     } else /* discover characterisitic */
     {
+      if (value_len < 3) {
+        android_errorWriteLog(0x534e4554, "158778659");
+        LOG(ERROR) << __func__ << " Illegal Response length, must be at least 3.";
+        gatt_end_operation(p_clcb, GATT_INVALID_PDU, NULL);
+        return;
+      }
       STREAM_TO_UINT8(record_value.dclr_value.char_prop, p);
       STREAM_TO_UINT16(record_value.dclr_value.val_handle, p);
       if (!GATT_HANDLE_IS_VALID(record_value.dclr_value.val_handle)) {