commit 70b639949a899e92248154ee1b127bdd2bfa0fc5
author Cheney Ni <cheneyni@google.com> Wed Aug 08 22:40:27 2018 +0800
committer Ryan Longair <rlongair@google.com> Wed Aug 15 15:28:49 2018 -0700
tree f836fa9c64c5937949d751a92f03e558375220cc
parent 9c379f4efd3000392eb43ed50b0254c193b12551

Checks the SMP length to fix OOB read

Bug: 111937065
Test: manual
Change-Id: I330880a6e1671d0117845430db4076dfe1aba688
Merged-In: I330880a6e1671d0117845430db4076dfe1aba688
(cherry picked from commit 353faee793b4f0ce349ef2c950902be561b64827)

stack/smp/smp_act.c

diff --git a/stack/smp/smp_act.c b/stack/smp/smp_act.c
index e3be538..c6ab118 100644
--- a/stack/smp/smp_act.c
+++ b/stack/smp/smp_act.c
@@ -1016,6 +1016,14 @@
     UINT8   *p = (UINT8 *)p_data;
 
     SMP_TRACE_DEBUG("%s", __func__);
+
+    if (smp_command_has_invalid_parameters(p_cb)) {
+        uint8_t reason = SMP_INVALID_PARAMETERS;
+        android_errorWriteLog(0x534e4554, "111937065");
+        smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
+        return;
+    }
+
     STREAM_TO_ARRAY(p_cb->ltk, p, BT_OCTET16_LEN);
 
     smp_key_distribution(p_cb, NULL);
@@ -1049,7 +1057,7 @@
 }
 
 /*******************************************************************************
-** Function     smp_proc_enc_info
+** Function     smp_proc_id_info
 ** Description  process identity information from peer device
 *******************************************************************************/
 void smp_proc_id_info(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
@@ -1057,6 +1065,14 @@
     UINT8   *p = (UINT8 *)p_data;
 
     SMP_TRACE_DEBUG("%s", __func__);
+
+    if (smp_command_has_invalid_parameters(p_cb)) {
+        uint8_t reason = SMP_INVALID_PARAMETERS;
+        android_errorWriteLog(0x534e4554, "111937065");
+        smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
+        return;
+    }
+
     STREAM_TO_ARRAY (p_cb->tk, p, BT_OCTET16_LEN);   /* reuse TK for IRK */
     smp_key_distribution_by_transport(p_cb, NULL);
 }