aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2024-05-14Merge cherrypicks of ['googleplex-android-review.googlesource.com/27059635'] ↵android-platform-12.0.0_r33android12-platform-releaseAndroid Build Coastguard Worker
into sc-platform-release. Change-Id: I14fadbbe1c6f7d7b714a6e223748519a51c3633d
2024-05-14Fix an authentication bypass bug in SMPBrian Delwiche
When pairing with BLE legacy pairing initiated from remote, authentication can be bypassed. This change fixes it. Bug: 251514170 Test: m com.android.btservices Test: manual run against PoC Ignore-AOSP-First: security (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:8a3dbadc71428a30b172a74343be08498c656747) Merged-In: I66b1f9a80060f48a604001829db8ea7c96c7b7f8 Change-Id: I66b1f9a80060f48a604001829db8ea7c96c7b7f8
2024-01-24Merge cherrypicks of ['googleplex-android-review.googlesource.com/25493876', ↵android-platform-12.0.0_r32android-platform-12.0.0_r31android-platform-12.0.0_r30android-platform-12.0.0_r29Android Build Coastguard Worker
'googleplex-android-review.googlesource.com/25532305', 'googleplex-android-review.googlesource.com/25658058', 'googleplex-android-review.googlesource.com/25677226', 'googleplex-android-review.googlesource.com/25842506'] into sc-platform-release. Change-Id: I22a16cf986e39bdf6e1b98ef74b8bdcc0a9d56c0
2024-01-24Fix a security bypass issue in access_secure_service_from_temp_bondHui Peng
Backport I48df2c2d77810077e97d4131540277273d441998 to rvc-dev Bug: 318374503 Test: m com.android.btservices | manual test against PoC | QA Ignore-AOSP-First: security (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:e908c16d9157b9e4a936117f06b8f964cf8386b8) Merged-In: Ib7cf66019b3d45a2a23d235ad5f9dc406394456f Change-Id: Ib7cf66019b3d45a2a23d235ad5f9dc406394456f
2024-01-24Reland: Fix an OOB write bug in attp_build_value_cmdHui Peng
This is a backport of I291fd665a68d90813b8c21c80d23cc438f84f285 Bug: 295887535 Bug: 315127634 Test: m com.android.btservices Test: atest net_test_stack_gatt Ignore-AOSP-First: security (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:70f7ff2b34e6683301c9c6cd021e1ddef76c5b1c) Merged-In: Ieffac6db5c6359b071efc599f7a70de609b80b72 Change-Id: Ieffac6db5c6359b071efc599f7a70de609b80b72
2024-01-24Revert "[conflict] Fix an OOB write bug in attp_build_value_cmd am: ↵Hui Peng
ddca760763 am: f1d188c940" This reverts commit 936dfb1c72137d1e53479afccd5bf5e37018c340. Reason for revert: b/315127634 (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:2fbe22151b079c9128b8c3e65c01b6f959b2f698) Merged-In: I331a93adbf534b44a2b6aade17469c27ce13cdb6 Change-Id: I331a93adbf534b44a2b6aade17469c27ce13cdb6
2024-01-24[conflict] Fix an OOB write bug in attp_build_value_cmd am: ddca760763 am: ↵Hui Peng
f1d188c940 Original change: https://googleplex-android-review.googlesource.com/c/platform/system/bt/+/25496662 Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:936dfb1c72137d1e53479afccd5bf5e37018c340) Merged-In: I418da36d704ebce76ca7e89fbb5fdd1954ddeab5 Change-Id: I418da36d704ebce76ca7e89fbb5fdd1954ddeab5
2024-01-24Fix an OOB bug in smp_proc_sec_reqHui Peng
This is a backport of I400cfa3523c6d8b25c233205748c2db5dc803d1d Bug: 300903400 Test: m com.android.btservices Ignore-AOSP-First: security (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:970c95d7c06c909c34a849587f701098129fc2ef) Merged-In: Id4c65801ff8519aff18b24007e344934493cab55 Change-Id: Id4c65801ff8519aff18b24007e344934493cab55
2024-01-09Merge cherrypicks of ['googleplex-android-review.googlesource.com/25658058'] ↵android-platform-12.0.0_r28Android Build Coastguard Worker
into sc-platform-release. Change-Id: Ibf4d33528260205e3c8393fac81a2329f85447a6
2024-01-09Revert "[conflict] Fix an OOB write bug in attp_build_value_cmd am: ↵Hui Peng
ddca760763 am: f1d188c940" This reverts commit 936dfb1c72137d1e53479afccd5bf5e37018c340. Reason for revert: b/315127634 (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:2fbe22151b079c9128b8c3e65c01b6f959b2f698) Merged-In: I331a93adbf534b44a2b6aade17469c27ce13cdb6 Change-Id: I331a93adbf534b44a2b6aade17469c27ce13cdb6
2023-12-12Merge cherrypicks of ['googleplex-android-review.googlesource.com/25496571', ↵Android Build Coastguard Worker
'googleplex-android-review.googlesource.com/25505593', 'googleplex-android-review.googlesource.com/25532305'] into sc-platform-release. Change-Id: I544f134c078054d448703648acca5196e1b41351
2023-12-12[conflict] Fix an OOB write bug in attp_build_value_cmd am: ddca760763 am: ↵Hui Peng
f1d188c940 Original change: https://googleplex-android-review.googlesource.com/c/platform/system/bt/+/25496662 Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:936dfb1c72137d1e53479afccd5bf5e37018c340) Merged-In: I418da36d704ebce76ca7e89fbb5fdd1954ddeab5 Change-Id: I418da36d704ebce76ca7e89fbb5fdd1954ddeab5
2023-12-12Fix an OOB write bug in attp_build_read_by_type_value_cmdHui Peng
This is a backport of I2a95bbcce9a16ac84dd714eb4561428711a9872e Bug: 297524203 Test: m com.android.btservices Ignore-AOSP-First: security (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:9cdac321797cbe8214bc3f6294ca9a71a4be07a7) Merged-In: I8c5daedb1605307df697ea5d875153dfcf3f5181 Change-Id: I8c5daedb1605307df697ea5d875153dfcf3f5181
2023-12-12Fix an OOB bug in btif_to_bta_response and attp_build_value_cmdHui Peng
this is a backport of Iefa66f3a293ac2072ba79853a9ec23cdfe4c1368 Bug: 276898739 Test: manual Tag: #security Ignore-AOSP-First: security (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:138120c65f9b5a03d462d01da9c5c7f71c875e1e) Merged-In: Ia13e47e416d43243e90fb1430f65ae68c50f9ff3 Change-Id: Ia13e47e416d43243e90fb1430f65ae68c50f9ff3
2023-11-28Merge cherrypicks of ['googleplex-android-review.googlesource.com/25011257'] ↵android-platform-12.0.0_r27Android Build Coastguard Worker
into sc-platform-release. Change-Id: I5cf1eb3621f7519404196e3858711cb6d15cdd15
2023-11-28[conflict] Merge "Fix some OOB errors in BTM parsing" into rvc-dev am: ↵Brian Delwiche
d8ecaf17b4 am: 91f5cb80a3 Original change: https://googleplex-android-review.googlesource.com/c/platform/system/bt/+/23399019 Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:71b8613d95d78817cda6c49f2a7e849ce4e99339) Merged-In: I294455124fbd06f5742b64f8bae5455f09358fe4 Change-Id: I294455124fbd06f5742b64f8bae5455f09358fe4
2023-11-07Merge cherrypicks of ['googleplex-android-review.googlesource.com/24574885'] ↵android-platform-12.0.0_r26Android Build Coastguard Worker
into sc-platform-release. Change-Id: I4bc3a43a4743f12fc4e71e6206132437db6708f7
2023-11-07RootCanal: Disable address and undefined sanitizersHenri Chataing
rootcanal in crashloop when host image is updated with libc6 deps update Ignore-AOSP-First: Issue occurs on sc-dev only Bug: 296892197 Test: NA (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:89484a800a9f21ac1cf0736af172da0b70d4dcb3) Merged-In: I13f716a8b7494bd7cc9400cc9bcd745072bdbe55 Change-Id: I13f716a8b7494bd7cc9400cc9bcd745072bdbe55
2023-10-23Merge cherrypicks of ['googleplex-android-review.googlesource.com/24738554', ↵Android Build Coastguard Worker
'googleplex-android-review.googlesource.com/24738555', 'googleplex-android-review.googlesource.com/24738556', 'googleplex-android-review.googlesource.com/24738557', 'googleplex-android-review.googlesource.com/24738558', 'googleplex-android-review.googlesource.com/24834612', 'googleplex-android-review.googlesource.com/24931700', 'googleplex-android-review.googlesource.com/24933651', 'googleplex-android-review.googlesource.com/23356859'] into sc-platform-release. Change-Id: Ia29331258fdc18e1dc444476c67fba0b2842a2f3
2023-10-23Add bounds checks in btif_avrcp_audio_track.ccBrian Delwiche
Fuzz testing reveals that the transcodeQ*ToFloat family of functions are not bounds checked, causing a potential OOB write. Check these functions against bounds of the destination array. Bug: 275895309 Test: atest bluetooth_test_gd_unit, net_test_stack_btm Tag: #security Ignore-AOSP-First: Security (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:ff1a4a98c75ac9d6b850655efb1eeaae3503a511) Merged-In: I7d47860e7636282e3f7f1b8001aa1aa3b6d0c12e Change-Id: I7d47860e7636282e3f7f1b8001aa1aa3b6d0c12e
2023-10-23Fix timing attack in BTM_BleVerifySignatureBrian Delwiche
BTM_BleVerifySignature uses a stock memcmp, allowing signature contents to be deduced through a side-channel attack. Change to CRYPTO_memcmp, which is hardened against this attack, to eliminate this attack. Bug: 274478807 Test: atest bluetooth_test_gd_unit Tag: #security Ignore-AOSP-First: Security (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:8fe5c711c9ec924b09e42888eb80f6f17b1c6630) Merged-In: Id2451e3b37030c22e8880710f602d4a0b9d24a50 Change-Id: Id2451e3b37030c22e8880710f602d4a0b9d24a50
2023-10-23Fix an OOB bug in parse_gap_dataHui Peng
Bug: 277590580 bug: 275553827 Test: atest net_test_main_shim Ignore-AOSP-First: security Tag: #security (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:98007dd44ef095cae8091b7a31b6c7456eb9db25) Merged-In: I7fcb7c46f668f48560a72399a3c5087c6da3827f Change-Id: I7fcb7c46f668f48560a72399a3c5087c6da3827f
2023-10-23Factor out duplicate code for parsing gap dataHui Peng
This change is intended to be used to factor out dup code for parsing GapData in StartAdvertisingSet and make it easier to be tested. Backport of Ia39886c415218353b6f9d59d7d3f6d1160477d6c Bug: 296291440 Test: atest net_test_main_shim Ignore-AOSP-First: security (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:b100ed7d1ec943e84fd96262304f41f87cf6e19f) Merged-In: Ia39886c415218353b6f9d59d7d3f6d1160477d6c Change-Id: Ia39886c415218353b6f9d59d7d3f6d1160477d6c
2023-10-23Enforce authentication if encryption is requiredHui Peng
Original bug Bug: 294854926 regressions: Bug: 299570702 Bug: 299561281 Test: Test: m com.android.btservices Test: QA validation Ignore-AOSP-First: security (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:475bb2486fdc5558363846873ca67fd994043e2e) Merged-In: I0370ed2e3166d56f708e1981c2126526e1db9eaa Change-Id: I0370ed2e3166d56f708e1981c2126526e1db9eaa
2023-10-23Reorganize the code for checking auth requirementHui Peng
Original bug Bug: 294854926 regressions: Bug: 299570702 Test: Test: m com.android.btservices Test: QA validation Ignore-AOSP-First: security (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:4c2b64caf4bb45c6c6ba010c2bfab304f3986509) Merged-In: I976a5a6d7bb819fd6accdc71eb1501b9606f3ae4 Change-Id: I976a5a6d7bb819fd6accdc71eb1501b9606f3ae4
2023-10-23Reject access to secure service authenticated from a temp bonding [3]Hui Peng
Allow access to rfcomm PSM by default Original bug Bug: 294854926 Nearby regressions: Bug: 298539299 Test: m com.android.btservices Ignore-AOSP-First: security (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:6a273c583f321c9ceed5237dc7de2bfeda719f44) Merged-In: If1f7c9278a9e877f64ae78b6f067c597fb5d0e66 Change-Id: If1f7c9278a9e877f64ae78b6f067c597fb5d0e66
2023-10-23Reject access to secure services authenticated from temp bonding [2]Hui Peng
Reject access to service running on rfcomm this is a backport of I10fcc2dcd78fc22ffbe3c425669fc9889b94a166 Bug: 294854926 Test: m com.android.btservices Ignore-AOSP-First: security (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:fcf6d4a112452e5d3a7076c7b38d8cc3ba938402) Merged-In: I10fcc2dcd78fc22ffbe3c425669fc9889b94a166 Change-Id: I10fcc2dcd78fc22ffbe3c425669fc9889b94a166
2023-10-23Reject access to secure service authenticated from a temp bonding [1]Hui Peng
Rejecct access to services running on l2cap Backport of Idef4ea28eb3d17b0807ab7dc6849433ddc5581b3 Bug: 294854926 Test: m com.android.btservices Ignore-AOSP-First: security (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:bb6e130192fd14e588518dd746d428a1ad731a24) Merged-In: Idef4ea28eb3d17b0807ab7dc6849433ddc5581b3 Change-Id: Idef4ea28eb3d17b0807ab7dc6849433ddc5581b3
2023-08-11Merge cherrypicks of ['googleplex-android-review.googlesource.com/24217076'] ↵android-platform-12.0.0_r25android-platform-12.0.0_r24Android Build Coastguard Worker
into sc-platform-release. Change-Id: Ib6dea5990f634dfb4228f6aeec30dadb66bd7574
2023-08-11Fix an integer underflow in build_read_multi_rspHui Peng
This is a backport of Ia60dd829ff9152c083de1f4c1265bb3ad595dcc4 to sc-dev Bug: 273874525 Test: manual Ignore-AOSP-First: security Tag: #security (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:d5f27984f4ca265f28a4adf5835b0198a3e19aed) Merged-In: Ia60dd829ff9152c083de1f4c1265bb3ad595dcc4 Change-Id: Ia60dd829ff9152c083de1f4c1265bb3ad595dcc4
2023-08-09Merge cherrypicks of ['googleplex-android-review.googlesource.com/24298359'] ↵android-platform-12.0.0_r23Android Build Coastguard Worker
into sc-platform-release. Change-Id: I89e758132d997483f2666eb636756d2c820af916
2023-08-09Revert "[conflict resolved] Merge "Fix a type confusion bug in ↵Hui Peng
bta_av_setconfig_rej" into rvc-dev am: 595218098a am: 569663e50a" This reverts commit 2e662f207536ae1a368db159d8522ebb33f07f70. Reason for revert: b/281788858 (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:1d61219875c96ca2faac39272fcb34c5890a29ca) Merged-In: I0aa36a850308048447399c0ea56fab885cba8b48 Change-Id: I0aa36a850308048447399c0ea56fab885cba8b48
2023-07-17Merge cherrypicks of ['googleplex-android-review.googlesource.com/23050528', ↵Android Build Coastguard Worker
'googleplex-android-review.googlesource.com/23267812', 'googleplex-android-review.googlesource.com/23270858', 'googleplex-android-review.googlesource.com/22912152', 'googleplex-android-review.googlesource.com/23524098'] into sc-platform-release. Change-Id: I2aa9e6e6fb9f636f78e96dccd8398ea243eacc7b
2023-07-17Fix UAF in gatt_cl.ccBrian Delwiche
gatt_cl.cc accesses a header field after the buffer holding it may have been freed. Track the relevant state as a local variable instead. Bug: 274617156 Test: atest: bluetooth, validated against fuzzer Tag: #security Ignore-AOSP-First: Security (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:d7a7f7f3311202065de4b2c17b49994053dd1244) Merged-In: I085ecfa1a9ba098ecbfecbd3cb3e263ae13f9724 Change-Id: I085ecfa1a9ba098ecbfecbd3cb3e263ae13f9724
2023-07-17Fix potential abort in btu_av_act.ccBrian Delwiche
Partner analysis shows that bta_av_rc_msg does not respect handling established for a null browse packet, instead dispatching the null pointer to bta_av_rc_free_browse_msg. Strictly speaking this does not cause a UAF, as osi_free_and_reset will find the null and abort, but it will lead to improper program termination. Handle the case instead. Bug: 269253349 Test: atest bluetooth_test_gd_unit Tag: #security Ignore-AOSP-First: Security (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:91f6d6215c101acc99a7397c5fb5a12fe6d7b8e9) Merged-In: I4df7045798b663fbefd7434288dc9383216171a7 Change-Id: I4df7045798b663fbefd7434288dc9383216171a7
2023-07-17Fix integer overflow in build_read_multi_rspBrian Delwiche
Local variables tracking structure size in build_read_multi_rsp are of uint16 type but accept a full uint16 range from function arguments while appending a fixed-length offset. This can lead to an integer overflow and unexpected behavior. Change the locals to size_t, and add a check during reasssignment. Bug: 273966636 Test: atest bluetooth_test_gd_unit, net_test_stack_btm Tag: #security Ignore-AOSP-First: Security (cherry picked from commit 70a4d628fa016a9487fae07f211644b95e1f0000) (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:c57ccd2b96e5ffcb9a57bc0e78038b5de28857d7) Merged-In: I3a74bdb0d003cb6bf4f282615be8c68836676715 Change-Id: I3a74bdb0d003cb6bf4f282615be8c68836676715
2023-07-17Fix an integer overflow bug in avdt_msg_asmblHui Peng
This is a backport of Iaa4d603921fc4ffb8cfb5783f99ec0963affd6a2 to rvc-dev Bug: 280633699 Test: manual Ignore-AOSP-First: security Tag: #security (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:26347d4bdba646bbba4d27337d2888a04de42639) Merged-In: Iaa4d603921fc4ffb8cfb5783f99ec0963affd6a2 Change-Id: Iaa4d603921fc4ffb8cfb5783f99ec0963affd6a2
2023-07-17[conflict resolved] Merge "Fix a type confusion bug in bta_av_setconfig_rej" ↵Hui Peng
into rvc-dev am: 595218098a am: 569663e50a Original change: https://googleplex-android-review.googlesource.com/c/platform/system/bt/+/22939797 Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:2e662f207536ae1a368db159d8522ebb33f07f70) Merged-In: I569ca8663f08f726b120bb6462c1cff7476d10f0 Change-Id: I569ca8663f08f726b120bb6462c1cff7476d10f0
2023-05-12Merge cherrypicks of ['googleplex-android-review.googlesource.com/22316070'] ↵android-platform-12.0.0_r22android-platform-12.0.0_r21Android Build Coastguard Worker
into sc-platform-release. Change-Id: I3675dc97d7dce42807208b978646c56ced553036
2023-05-12Fix gatt_end_operation buffer overflowtyiu
Added boundary check for gatt_end_operation to prevent writing out of boundary. Since response of the GATT server is handled in gatt_client_handle_server_rsp() and gatt_process_read_rsp(), the maximum lenth that can be passed into the handlers is bounded by GATT_MAX_MTU_SIZE, which is set to 517, which is greater than GATT_MAX_ATTR_LEN which is set to 512. The fact that there is no spec that gaurentees MTU response to be less than or equal to 512 bytes can cause a buffer overflow when performing memcpy without length check. Bug: 261068592 Test: No test since not affecting behavior Tag: #security Ignore-AOSP-First: security (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:dd7298e982e4bbf0138a490562679c9a4a755200) Merged-In: I49e2797cd9300ee4cd69f2c7fa5f0073db78b873 Change-Id: I49e2797cd9300ee4cd69f2c7fa5f0073db78b873
2023-04-18Merge cherrypicks of ['googleplex-android-review.googlesource.com/20169890', ↵android-platform-12.0.0_r20Android Build Coastguard Worker
'googleplex-android-review.googlesource.com/22188942', 'googleplex-android-review.googlesource.com/22188946'] into sc-platform-release. Change-Id: I15c3f6ae3c2b20c60e024fe4a8eb4f72a951f703
2023-04-18Revert "Revert "Fix wrong BR/EDR link key downgrades (P_256->P_192)""Brian Delwiche
This reverts commit d733c86cbc06ce0ec72216b9d41e172d1939c46f. Function btm_sec_encrypt_change() is called at most places with argument "encr_enable" treated as bool and not as per (tHCI_ENCRYPT_MODE = 0/1/2) expected by the function. The function has special handling for "encr_enable=1" to downgrade the link key type for BR/EDR case. This gets executed even when the caller/context did not mean/expect so. It appears this handling in btm_sec_encrypt_change() is not necessary and is removed by this commit to prevent accidental execution of it. Test: Verified re-pairing with an iPhone works fine now Issue Reproduction Steps: 1. Enable Bluetooth Hotspot on Android device (DUT). 2. Pair and connect an iPhone to DUT. 3. Forget this pairing on DUT. 4. On iPhone settings, click on old DUT's paired entry to connect. 5. iPhone notifies to click 'Forget Device' and try fresh pairing. 6. On iPhone, after doing 'Forget Device', discover DUT again. 7. Attempt pairing to DUT by clicking on discovered DUT entry. Pairing will be unsuccessful. Issue Cause: During re-pairing, DUT is seen to downgrade BR/EDR link key unexpectedly from link key type 0x8 (BTM_LKEY_TYPE_AUTH_COMB_P_256) to 0x5 (BTM_LKEY_TYPE_AUTH_COMB). Log snippet (re-pairing time): btm_sec_link_key_notification set new_encr_key_256 to 1 btif_dm_auth_cmpl_evt: Storing link key. key_type=0x8, bond_type=1 btm_sec_encrypt_change new_encr_key_256 is 1 --On DUT, HCI_Encryption_Key_Refresh_Complete event noticed--- btm_sec_encrypt_change new_encr_key_256 is 0 updated link key type to 5 btif_dm_auth_cmpl_evt: Storing link key. key_type=0x5, bond_type=1 This is a backport of the following patch: aosp/1890096 Bug: 258834033 Reason for revert: Reinstate original change for QPR (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:56891eedc68c86b40977191dad28d65ebf86a94f) Merged-In: Iba0c220b82bcf6b15368762b7052a3987ccbc0c6 Change-Id: Iba0c220b82bcf6b15368762b7052a3987ccbc0c6
2023-04-18Revert "[automerge] Revert "Validate buffer length in sdpu_build..."Brian Delwiche
Revert submission 21967285-revert-20730235-239414876-fix-s-VSMBOSXYDZ Reason for revert: Reinstate original change for QPR Reverted changes: /q/submissionid:21967285-revert-20730235-239414876-fix-s-VSMBOSXYDZ (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:57c0946be7cea3868c1a88cabbccc3dc6eaa4bf7) Merged-In: I1ec071f77f951981a5dc0aa2691e5be9d81677f8 Change-Id: I1ec071f77f951981a5dc0aa2691e5be9d81677f8
2023-04-18Prevent use-after-free of HID reportsBrian Delwiche
BTA sends the the HID report pointer to BTIF and deallocates it immediately. This is now prevented by providing a deep copy callback function for HID reports when tranferring context from BTA to BTIF. This is a backport of change Icef7a7ed1185b4283ee4fe4f812ca154d8f1b825, already merged on T for b/227620181. Bug: 228837201 Test: Validated against researcher POC, ran BT unit tests, played audio manually. Tag: #security Ignore-AOSP-First: Security (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:874c495c886cd8722625756dc5fd0634b16b4f42) Merged-In: Ib837f395883de2369207f1b3b974d6bff02dcb19 Change-Id: Ib837f395883de2369207f1b3b974d6bff02dcb19
2023-02-13Merge cherrypicks of ['googleplex-android-review.googlesource.com/20672923', ↵android-platform-12.0.0_r19android-platform-12.0.0_r18Android Build Coastguard Worker
'googleplex-android-review.googlesource.com/20614756', 'googleplex-android-review.googlesource.com/20614757', 'googleplex-android-review.googlesource.com/20614758', 'googleplex-android-review.googlesource.com/21060030'] into sc-platform-release. Change-Id: I25555f3e312870a88b187eeaa4795334dea72bfb
2023-02-13Fix an OOB bug in register_notification_rspHui Peng
This is a backport of I901d973a736678d7f3cc816ddf0cbbcbbd1fe93f to rvc-dev. Bug: 245916076 Test: manual Ignore-AOSP-First: security Change-Id: I37a9f45e707702b2ec52b5a2d572f177f2911765 (cherry picked from commit 901e34203c6280d414cbfa3978de04fd6515ffdf) Merged-In: I37a9f45e707702b2ec52b5a2d572f177f2911765
2023-02-13Add regression test for b/254774758Hui Peng
Note: this is a manual cherrypick of I1709af943b6fa238dd4df41a62e6add36984c9ec Bug: 254774758 Ignore-AOSP-First: security Test: atest bluetooth_test_gd_unit Change-Id: If40eb63e00c1a97e15dcdfdbbf12fad1070cd97b (cherry picked from commit 6059eb91d45d87a8e339bd0928a5837e6a96a324) Merged-In: If40eb63e00c1a97e15dcdfdbbf12fad1070cd97b
2023-02-13Add mocking support for now function in AttributionProcessorHui Peng
The triggering of the code we want to test depends on the return value of std::chrono::system_clock::now(). To facilicate testing, in this patch we add a now_func_ field in AttributionProcessor and make it call it instead of std::chrono::system_clock::now(). Mocking `now` is made possible by passing a custom function to the constructor of AttributionProcessor. Note: 1. This is a manual cherrypick of I7dd3a0e665f72c27e4d1844f45ec15a8dd1ddb53 Bug: 254774758 Test: refactoring, existing tests still pass Ignore-AOSP-First: security Change-Id: I1526d794ddd86f53a189f3ff226bddbff7a487e5 (cherry picked from commit 7378585e68bdccd53e2b713d474229310f0672d0) Merged-In: I1526d794ddd86f53a189f3ff226bddbff7a487e5
2023-02-13Fix a use-after-free bug in AttributionProcessor::OnWakelockReleasedHui Peng
There is a use-after-free bug in AttributionProcessor::OnWakelockReleased resulted from a well-known misuse of using iterators to delete items in containers (the deleted items are used for calculating the next iterator in the next round). This patch fix it with correct usage. Note: 1. This is a cherry-pick of If9f14d5fe2fbf2150f2ab0d1f90ce0f263399227 2. The regression test is: If40eb63e00c1a97e15dcdfdbbf12fad1070cd97b Bug: 254774758 Ignore-AOSP-First: security Test: atest bluetooth_test_gd_unit Change-Id: I75576e59e0c81a82473a68a6c5ba3ce882a84f99 (cherry picked from commit 9774aeff84a834ae4403300b5ef88f0a4635e9ac) Merged-In: I75576e59e0c81a82473a68a6c5ba3ce882a84f99
2023-02-13Fix OOB access in avdt_scb_hdl_pkt_no_fragHui Peng
This is a back port of the following 2 CLs: - Id13b1ebde8f603123c8b7a49922b2f1378ab788f - If0c7b25f2e6cb4531bbb6254e176e8ad1b5c5fb4 Regression test: I9c87e30ed58e7ad6a34ab7c96b0a8fb06324ad54 Bug: 142546355 258057241 Test: atest net_test_stack_avdtp Ignore-AOSP-First: security Change-Id: Ie1707385d6452ece47915c153f4faaa1c8a287c9 (cherry picked from commit b0b968e8c6214e20a5dc3617d66567225df0884f) Merged-In: Ie1707385d6452ece47915c153f4faaa1c8a287c9
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-11 02:06:42 +0000