Skip to content

Commit 8b7cd4d

Browse files
jack0cjack0c
committed
Merge branch 'bugfix/hfp_ag_idx_invalid_v5.1' into 'release/v5.1'
bt: Fixed out of bounds access due to variable length array(v5.1) See merge request espressif/esp-idf!23665
2 parents 57b31ed + 7ddb440 commit 8b7cd4d

File tree

4 files changed

+37
-22
lines changed

4 files changed

+37
-22
lines changed

‎components/bt/host/bluedroid/bta/hf_ag/bta_ag_act.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,7 @@ static void bta_ag_cback_open(tBTA_AG_SCB *p_scb, tBTA_AG_DATA *p_data, tBTA_AG_
9494
/* call app callback with open event */
9595
open.hdr.handle = bta_ag_scb_to_idx(p_scb);
9696
open.hdr.app_id = p_scb->app_id;
97-
open.status = status;
97+
open.hdr.status = status;
9898
open.service_id = bta_ag_svc_id[p_scb->conn_service];
9999
if (p_data) {
100100
/* if p_data is provided then we need to pick the bd address from the open api structure */
@@ -131,7 +131,7 @@ void bta_ag_register(tBTA_AG_SCB *p_scb, tBTA_AG_DATA *p_data)
131131
/* call app callback with register event */
132132
reg.hdr.handle = bta_ag_scb_to_idx(p_scb);
133133
reg.hdr.app_id = p_scb->app_id;
134-
reg.status = BTA_AG_SUCCESS;
134+
reg.hdr.status = BTA_AG_SUCCESS;
135135
(*bta_ag_cb.p_cback)(BTA_AG_REGISTER_EVT, (tBTA_AG *) &reg);
136136
}
137137

‎components/bt/host/bluedroid/bta/hf_ag/bta_ag_main.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -831,7 +831,7 @@ static void bta_ag_api_register(tBTA_AG_DATA *p_data)
831831
APPL_TRACE_DEBUG("bta_ag_api_register: p_scb 0x%08x ", (unsigned int)p_scb);
832832
bta_ag_sm_execute(p_scb, p_data->hdr.event, p_data);
833833
} else {
834-
reg.status = BTA_AG_FAIL_RESOURCES;
834+
reg.hdr.status = BTA_AG_FAIL_RESOURCES;
835835
(*bta_ag_cb.p_cback)(BTA_AG_REGISTER_EVT, (tBTA_AG *) &reg);
836836
}
837837
}

‎components/bt/host/bluedroid/bta/include/bta/bta_ag_api.h

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -333,8 +333,6 @@ typedef struct
333333
typedef struct
334334
{
335335
tBTA_AG_HDR hdr;
336-
UINT16 handle;
337-
tBTA_AG_STATUS status;
338336
} tBTA_AG_REGISTER;
339337

340338
/* data associated with BTA_AG_OPEN_EVT */
@@ -343,7 +341,6 @@ typedef struct
343341
tBTA_AG_HDR hdr;
344342
BD_ADDR bd_addr;
345343
tBTA_SERVICE_ID service_id;
346-
tBTA_AG_STATUS status;
347344
} tBTA_AG_OPEN;
348345

349346
/* data associated with BTA_AG_CLOSE_EVT */

‎components/bt/host/bluedroid/btc/profile/std/hf_ag/btc_hf_ag.c

Lines changed: 34 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,14 @@ do {
134134
hf_local_param[idx].btc_hf_cb.num_active = 0; \
135135
hf_local_param[idx].btc_hf_cb.num_held = 0;
136136

137+
#define CHECK_HF_IDX(idx) \
138+
do { \
139+
if ((idx < 0) || (idx >= BTC_HF_NUM_CB)) { \
140+
BTC_TRACE_ERROR("%s: Invalid index %d", __FUNCTION__, idx); \
141+
return; \
142+
} \
143+
} while (0)
144+
137145
/************************************************************************************
138146
** Static Function
139147
************************************************************************************/
@@ -1213,19 +1221,9 @@ void btc_hf_cb_handler(btc_msg_t *msg)
12131221
tBTA_AG *p_data = (tBTA_AG *)msg->arg;
12141222
esp_hf_cb_param_t param;
12151223
bdstr_t bdstr;
1216-
int idx;
1217-
1218-
if (p_data == NULL) {
1219-
idx = BTC_HF_INVALID_IDX;
1220-
} else {
1221-
idx = p_data->hdr.handle - 1;
1222-
}
1224+
int idx = BTC_HF_INVALID_IDX;
12231225

12241226
BTC_TRACE_DEBUG("%s: event = %s", __FUNCTION__, dump_hf_event(event));
1225-
if ((idx < 0) || (idx >= BTC_HF_NUM_CB)) {
1226-
BTC_TRACE_ERROR("%s: Invalid index %d", __FUNCTION__, idx);
1227-
return;
1228-
}
12291227

12301228
switch (event) {
12311229
case BTA_AG_ENABLE_EVT:
@@ -1234,6 +1232,8 @@ void btc_hf_cb_handler(btc_msg_t *msg)
12341232

12351233
case BTA_AG_REGISTER_EVT:
12361234
{
1235+
idx = p_data->hdr.handle - 1;
1236+
CHECK_HF_IDX(idx);
12371237
hf_local_param[idx].btc_hf_cb.handle = p_data->reg.hdr.handle;
12381238
BTC_TRACE_DEBUG("%s: BTA_AG_REGISTER_EVT," "hf_local_param[%d].btc_hf_cb.handle = %d",
12391239
__FUNCTION__, idx, hf_local_param[idx].btc_hf_cb.handle);
@@ -1242,7 +1242,9 @@ void btc_hf_cb_handler(btc_msg_t *msg)
12421242

12431243
case BTA_AG_OPEN_EVT:
12441244
{
1245-
if (p_data->open.status == BTA_AG_SUCCESS)
1245+
idx = p_data->hdr.handle - 1;
1246+
CHECK_HF_IDX(idx);
1247+
if (p_data->open.hdr.status == BTA_AG_SUCCESS)
12461248
{
12471249
bdcpy(hf_local_param[idx].btc_hf_cb.connected_bda.address, p_data->open.bd_addr);
12481250
hf_local_param[idx].btc_hf_cb.connection_state = ESP_HF_CONNECTION_STATE_CONNECTED;
@@ -1253,7 +1255,7 @@ void btc_hf_cb_handler(btc_msg_t *msg)
12531255
hf_local_param[idx].btc_hf_cb.connection_state = ESP_HF_CONNECTION_STATE_DISCONNECTED;
12541256
} else {
12551257
BTC_TRACE_WARNING("%s: AG open failed, but another device connected. status=%d state=%d connected device=%s", __FUNCTION__,
1256-
p_data->open.status, hf_local_param[idx].btc_hf_cb.connection_state,
1258+
p_data->open.hdr.status, hf_local_param[idx].btc_hf_cb.connection_state,
12571259
bdaddr_to_string(&hf_local_param[idx].btc_hf_cb.connected_bda, bdstr, sizeof(bdstr)));
12581260
break;
12591261
}
@@ -1270,13 +1272,15 @@ void btc_hf_cb_handler(btc_msg_t *msg)
12701272
if (hf_local_param[idx].btc_hf_cb.connection_state == ESP_HF_CONNECTION_STATE_DISCONNECTED)
12711273
bdsetany(hf_local_param[idx].btc_hf_cb.connected_bda.address);
12721274

1273-
if (p_data->open.status != BTA_AG_SUCCESS)
1275+
if (p_data->open.hdr.status != BTA_AG_SUCCESS)
12741276
btc_queue_advance();
12751277
break;
12761278
}
12771279

12781280
case BTA_AG_CONN_EVT:
12791281
{
1282+
idx = p_data->hdr.handle - 1;
1283+
CHECK_HF_IDX(idx);
12801284
clock_gettime(CLOCK_MONOTONIC, &(hf_local_param[idx].btc_hf_cb.connected_timestamp));
12811285
BTC_TRACE_DEBUG("%s: BTA_AG_CONN_EVT, idx = %d ", __FUNCTION__, idx);
12821286
hf_local_param[idx].btc_hf_cb.peer_feat = p_data->conn.peer_feat;
@@ -1298,6 +1302,8 @@ void btc_hf_cb_handler(btc_msg_t *msg)
12981302

12991303
case BTA_AG_CLOSE_EVT:
13001304
{
1305+
idx = p_data->hdr.handle - 1;
1306+
CHECK_HF_IDX(idx);
13011307
hf_local_param[idx].btc_hf_cb.connected_timestamp.tv_sec = 0;
13021308
hf_local_param[idx].btc_hf_cb.connection_state = ESP_HF_CONNECTION_STATE_DISCONNECTED;
13031309
BTC_TRACE_DEBUG("%s: BTA_AG_CLOSE_EVT," "hf_local_param[%d].btc_hf_cb.handle = %d", __FUNCTION__,
@@ -1319,6 +1325,8 @@ void btc_hf_cb_handler(btc_msg_t *msg)
13191325

13201326
case BTA_AG_AUDIO_OPEN_EVT:
13211327
{
1328+
idx = p_data->hdr.handle - 1;
1329+
CHECK_HF_IDX(idx);
13221330
do {
13231331
memset(&param, 0, sizeof(esp_hf_cb_param_t));
13241332
param.audio_stat.state = ESP_HF_AUDIO_STATE_CONNECTED;
@@ -1330,6 +1338,8 @@ void btc_hf_cb_handler(btc_msg_t *msg)
13301338

13311339
case BTA_AG_AUDIO_MSBC_OPEN_EVT:
13321340
{
1341+
idx = p_data->hdr.handle - 1;
1342+
CHECK_HF_IDX(idx);
13331343
do {
13341344
memset(&param, 0, sizeof(esp_hf_cb_param_t));
13351345
param.audio_stat.state = ESP_HF_AUDIO_STATE_CONNECTED_MSBC;
@@ -1340,6 +1350,8 @@ void btc_hf_cb_handler(btc_msg_t *msg)
13401350
}
13411351
case BTA_AG_AUDIO_CLOSE_EVT:
13421352
{
1353+
idx = p_data->hdr.handle - 1;
1354+
CHECK_HF_IDX(idx);
13431355
do {
13441356
memset(&param, 0, sizeof(esp_hf_cb_param_t));
13451357
param.audio_stat.state = ESP_HF_AUDIO_STATE_DISCONNECTED;
@@ -1351,6 +1363,8 @@ void btc_hf_cb_handler(btc_msg_t *msg)
13511363

13521364
case BTA_AG_AT_BVRA_EVT:
13531365
{
1366+
idx = p_data->hdr.handle - 1;
1367+
CHECK_HF_IDX(idx);
13541368
do {
13551369
memset(&param, 0, sizeof(esp_hf_cb_param_t));
13561370
param.vra_rep.value = p_data->val.num;
@@ -1468,6 +1482,8 @@ void btc_hf_cb_handler(btc_msg_t *msg)
14681482
case BTA_AG_AT_BINP_EVT:
14691483
case BTA_AG_AT_BTRH_EVT:
14701484
{
1485+
idx = p_data->hdr.handle - 1;
1486+
CHECK_HF_IDX(idx);
14711487
tBTA_AG_RES_DATA ag_res;
14721488
memset(&ag_res, 0, sizeof(ag_res));
14731489
ag_res.ok_flag = BTA_AG_OK_ERROR;
@@ -1478,6 +1494,8 @@ void btc_hf_cb_handler(btc_msg_t *msg)
14781494

14791495
case BTA_AG_AT_BAC_EVT:
14801496
{
1497+
idx = p_data->hdr.handle - 1;
1498+
CHECK_HF_IDX(idx);
14811499
BTC_TRACE_DEBUG("AG Bitmap of peer-codecs %d", p_data->val.num);
14821500
#if (BTM_WBS_INCLUDED == TRUE)
14831501
/* If the peer supports mSBC and the BTC prefferred codec is also mSBC, then
@@ -1497,9 +1515,9 @@ void btc_hf_cb_handler(btc_msg_t *msg)
14971515
#if (BTM_WBS_INCLUDED == TRUE)
14981516
case BTA_AG_WBS_EVT:
14991517
{
1500-
BTC_TRACE_DEBUG("Set codec status %d codec %d 1=CVSD 2=MSBC", p_data->val.hdr.status, p_data->val.value);
1518+
BTC_TRACE_DEBUG("Set codec status %d codec %d 1=CVSD 2=MSBC", p_data->val.hdr.status, p_data->val.num);
15011519
memset(&param, 0, sizeof(esp_hf_cb_param_t));
1502-
param.wbs_rep.codec = p_data->val.value;
1520+
param.wbs_rep.codec = p_data->val.num;
15031521
btc_hf_cb_to_app(ESP_HF_WBS_RESPONSE_EVT, &param);
15041522
break;
15051523
}

0 commit comments

Comments
 (0)