commit eeefcc7c75af2f41caba0de0175d3d843c4e882f
author Chris Manton <cmanton@google.com> Mon Nov 08 16:45:42 2021 -0800
committer Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Wed Dec 15 00:03:30 2021 +0000
tree e27220e4cdba2fe91b2ea5f285a23e36f7cf709b
parent 8d73f74a7b6a57893df2e277faa9204ec2a267d5

security: Use-After-Free in btm_sec_[dis]connected

Bug: 201083442
Tag: #security
Test: gd/cert/run
Ignore-AOSP-First: Security

Change-Id: I69c362d1eb644a3b7fd967cd526a8a58c3b4d975
(cherry picked from commit 735f046c5c6263321d3acfc4261bd1cf36b029b0)
Merged-In:I69c362d1eb644a3b7fd967cd526a8a58c3b4d975

stack/btm/btm_sec.cc

diff --git a/stack/btm/btm_sec.cc b/stack/btm/btm_sec.cc
index 50bd604..4b5d70d 100644
--- a/stack/btm/btm_sec.cc
+++ b/stack/btm/btm_sec.cc
@@ -3385,7 +3385,6 @@
 void btm_sec_connected(const RawAddress& bda, uint16_t handle,
                        tHCI_STATUS status, uint8_t enc_mode,
                        tHCI_ROLE assigned_role) {
-  tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(bda);
   tBTM_STATUS res;
   bool is_pairing_device = false;
   bool addr_matched;
@@ -3393,6 +3392,7 @@
 
   btm_acl_resubmit_page();
 
+  tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(bda);
   if (!p_dev_rec) {
     LOG_DEBUG(
         "Connected to new device state:%s handle:0x%04x status:%s "