diff options
| author | tyiu <tyiu@google.com> | 2023-03-28 18:40:51 +0000 |
|---|---|---|
| committer | Android Build Coastguard Worker <android-build-coastguard-worker@google.com> | 2023-05-12 15:55:42 +0000 |
| commit | c75bcc44f3cbb8c597dd98958f4d8c13db918074 (patch) | |
| tree | e3b50777c8ae84f7fa3614ec637f2949bb152c36 | |
| parent | 74752c177ec2390393e992d9828a2177c943a99b (diff) | |
| download | bt-c75bcc44f3cbb8c597dd98958f4d8c13db918074.tar.gz | |
Fix gatt_end_operation buffer overflow
Added boundary check for gatt_end_operation to prevent writing out of
boundary.
Since response of the GATT server is handled in
gatt_client_handle_server_rsp() and gatt_process_read_rsp(), the maximum
lenth that can be passed into the handlers is bounded by
GATT_MAX_MTU_SIZE, which is set to 517, which is greater than
GATT_MAX_ATTR_LEN which is set to 512. The fact that there is no spec
that gaurentees MTU response to be less than or equal to 512 bytes can
cause a buffer overflow when performing memcpy without length check.
Bug: 261068592
Test: No test since not affecting behavior
Tag: #security
Ignore-AOSP-First: security
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:dd7298e982e4bbf0138a490562679c9a4a755200)
Merged-In: I49e2797cd9300ee4cd69f2c7fa5f0073db78b873
Change-Id: I49e2797cd9300ee4cd69f2c7fa5f0073db78b873
| -rw-r--r-- | stack/gatt/gatt_utils.cc | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/stack/gatt/gatt_utils.cc b/stack/gatt/gatt_utils.cc index 146dee207..a2977e843 100644 --- a/stack/gatt/gatt_utils.cc +++ b/stack/gatt/gatt_utils.cc @@ -1498,6 +1498,13 @@ void gatt_end_operation(tGATT_CLCB* p_clcb, tGATT_STATUS status, void* p_data) { cb_data.att_value.handle = p_clcb->s_handle; cb_data.att_value.len = p_clcb->counter; + if (cb_data.att_value.len > GATT_MAX_ATTR_LEN) { + LOG(WARNING) << __func__ + << StringPrintf(" Large cb_data.att_value, size=%d", + cb_data.att_value.len); + cb_data.att_value.len = GATT_MAX_ATTR_LEN; + } + if (p_data && p_clcb->counter) memcpy(cb_data.att_value.value, p_data, cb_data.att_value.len); } |