Commits · 31d229974e9e096b84b3bf8730cd18db41dcb2b9 · LMODroid / platform_packages_modules_Bluetooth

Jun 05, 2023

Import translations. DO NOT MERGE ANYWHERE · 31d22997

Bill Yi authored 1 year ago

Auto-generated-cl: translation import
Change-Id: I2345c2b02fb7b4ebb75c1d012fe77bd0e6fd50f7

31d22997

Jun 02, 2023

Merge "Fix UAF in gatt_cl.cc" into tm-dev am: am: · 6c4ef160

Brian Delwiche authored 1 year ago

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/22581496

Change-Id: I89af4509c56b2c6c8c836e14e004209314abb38b
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

6c4ef160

Merge "Fix UAF in gatt_cl.cc" into tm-dev am: · 91c161a1

Brian Delwiche authored 1 year ago

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/22581496

Change-Id: Ib7c9450d1ead66dd16c00ae3591c2c7efc7b7a7f
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

91c161a1

Merge "Fix UAF in gatt_cl.cc" into tm-dev · 813e5845
Brian Delwiche authored 1 year ago

813e5845

May 24, 2023

Merge "Fix potential abort in btu_av_act.cc" into tm-dev am: am: · b3462f0f

Brian Delwiche authored 1 year ago

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/21609715

Change-Id: I9dd980ac9357ade7cdcd885e81145ffab9020e4b
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

b3462f0f

Merge "Fix potential abort in btu_av_act.cc" into tm-dev am: · 9d48efea

Brian Delwiche authored 1 year ago

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/21609715

Change-Id: I8706187fb778ea1ca35291b08773fb52181dc335
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

9d48efea

Merge "Fix potential abort in btu_av_act.cc" into tm-dev · 9607396b
Brian Delwiche authored 1 year ago

9607396b

May 22, 2023

Import translations. DO NOT MERGE ANYWHERE · ad6b0811

Bill Yi authored 1 year ago

Auto-generated-cl: translation import
Change-Id: I5fec6f37af61825ce9f20a4b3d7c471f6629a3e3

ad6b0811

May 19, 2023

Merge "Fix integer overflow in build_read_multi_rsp" into tm-dev am: am: · 90c8779b

Brian Delwiche authored 1 year ago

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/22726306

Change-Id: Id4949daa2c63b7ab132e23efe4f9c2e21541864e
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

90c8779b

Merge "Fix integer overflow in build_read_multi_rsp" into tm-dev am: · 95966322

Brian Delwiche authored 1 year ago

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/22726306

Change-Id: I5dc67f531b235302c6bf8904609af1d7e0d869b9
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

95966322

May 18, 2023
- Merge "Fix integer overflow in build_read_multi_rsp" into tm-dev · 0db5f1b1
  Brian Delwiche authored 1 year ago
  
  0db5f1b1
May 17, 2023

Merge "Import translations. DO NOT MERGE ANYWHERE" into tm-qpr-dev · 4aedd9bf
TreeHugger Robot authored 1 year ago

4aedd9bf

Fix an integer overflow bug in avdt_msg_asmbl am: am: · 5e673575

Hui Peng authored 1 year ago

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/23152778

Change-Id: Ia79662831bfe5d8a40a7c9b63e9f2eaf15b19852
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

5e673575

Fix an integer overflow bug in avdt_msg_asmbl am: · df75554b

Hui Peng authored 1 year ago

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/23152778

Change-Id: I0d6c9381f451aba707f54c1da27319b5ee097a0d
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

df75554b

Import translations. DO NOT MERGE ANYWHERE · 6a69cc56

Bill Yi authored 1 year ago

Auto-generated-cl: translation import
Change-Id: If5e4e4cd37f0ea71f1344c17979fdade36535e00

6a69cc56

May 16, 2023

Fix an integer overflow bug in avdt_msg_asmbl · bf9449a7

Hui Peng authored 1 year ago

Bug: 280633699
Test: manual
Ignore-AOSP-First: security
Tag: #security
Change-Id: Iaa4d603921fc4ffb8cfb5783f99ec0963affd6a2

bf9449a7

Fix integer overflow in build_read_multi_rsp · badb8ffc

Brian Delwiche authored 1 year ago

Local variables tracking structure size in build_read_multi_rsp are of
uint16 type but accept a full uint16 range from function arguments while
appending a fixed-length offset.  This can lead to an integer overflow
and unexpected behavior.

Change the locals to size_t, and add a check during reasssignment.

Bug: 273966636
Test: atest bluetooth_test_gd_unit, net_test_stack_btm
Tag: #security
Ignore-AOSP-First: Security
Change-Id: I3a74bdb0d003cb6bf4f282615be8c68836676715
(cherry picked from commit 70a4d628)

badb8ffc

Merge "Fix a NPD in sdpu_find_profile_version" into tm-dev am: am: · a120c15e

Hui Peng authored 1 year ago

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/23139401

Change-Id: Ica98719163a78784335dab78af44bb5cdc615fbf
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

a120c15e

Merge "Fix a NPD in sdpu_find_profile_version" into tm-dev am: · 5b789300

Hui Peng authored 1 year ago

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/23139401

Change-Id: I7c10e2ad52871e80aedb37b65500498fe494908f
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

5b789300

May 15, 2023

Merge "Fix a NPD in sdpu_find_profile_version" into tm-dev · 648f7433
Hui Peng authored 1 year ago

648f7433

[automerger skipped] [resolved conflict] Fix multiple OOB bugs resulted from... · 7256f462

Hui Peng authored 1 year ago

[automerger skipped] [resolved conflict] Fix multiple OOB bugs resulted from tx mtu in EATT am: ea76b7d9 am: 3b942b84 -s ours

am skip reason: Merged-In Ia06c9a17f2daa5ce4c32cffa536777f47774cf31 with SHA-1 282d4a18 is already in history

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/23228877



Change-Id: I43d2bde46740879d4114e2b9a07c9850b1825b52
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

7256f462

May 13, 2023

[resolved conflict] Fix multiple OOB bugs resulted from tx mtu in EATT am: · 3b942b84

Hui Peng authored 1 year ago

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/23152794



Bug: 271335899
Test: manual
Ignore-AOSP-First: security
Tag: #security
Merged-In: Ia06c9a17f2daa5ce4c32cffa536777f47774cf31
Change-Id: I02f1aec42e0c12c8f53fe03090b0c40c6e8e51c5
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

3b942b84

Merge "Fix multiple OOB bugs resulted from tx mtu in EATT" into tm-qpr-dev · 9b06bf53
Hui Peng authored 1 year ago

9b06bf53

May 12, 2023

Fix multiple OOB bugs resulted from tx mtu in EATT · ea76b7d9

Hui Peng authored 1 year ago

The tx mtu in EATT can be controlled by remote device. With malicious
mtu values, it is possible to trigger integer overflow and
OOB write at multiple places (see the bug below).

This fix enforces a max tx mtu in EATT.

Bug: 271335899
Test: manual
Ignore-AOSP-First: security
Tag: #security
Merged-In: Ia06c9a17f2daa5ce4c32cffa536777f47774cf31
Change-Id: Ia06c9a17f2daa5ce4c32cffa536777f47774cf31

ea76b7d9

Fix multiple OOB bugs resulted from tx mtu in EATT · 282d4a18

Hui Peng authored 1 year ago

The tx mtu in EATT can be controlled by remote device. With malicious
mtu values, it is possible to trigger integer overflow and
OOB write at multiple places (see the bug below).

This fix enforces a max tx mtu in EATT.

Bug: 271335899
Test: manual
Ignore-AOSP-First: security
Tag: #security
Change-Id: Ia06c9a17f2daa5ce4c32cffa536777f47774cf31

282d4a18

Merge "Import translations. DO NOT MERGE ANYWHERE" into tm-qpr-dev · ee7f799b
Bill Yi authored 1 year ago

ee7f799b

May 10, 2023

Fix a NPD in sdpu_find_profile_version · 2de20485

Hui Peng authored 1 year ago

Bug: 278279023
Test: manual
Ignore-AOSP-First: security
Tag: #security
Change-Id: I6727c9a071170baadb2292daa52f71190972ecca

2de20485

Merge "Fix an OOB bug in bta_av_proc_meta_cmd" into tm-dev am: am: · 95545b56

Treehugger Robot authored 1 year ago

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/22940765

Change-Id: I710fec3df81336f5c8863dbb600e1e79c6a12c81
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

95545b56

Merge "Fix an OOB bug in bta_av_proc_meta_cmd" into tm-dev am: · 4a1a9611

Treehugger Robot authored 1 year ago

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/22940765

Change-Id: Ib3381da1f681834da0be152053e92a5944269f65
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

4a1a9611

May 09, 2023
- Merge "Fix an OOB bug in bta_av_proc_meta_cmd" into tm-dev · 77089c95
  Treehugger Robot authored 1 year ago
  
  77089c95
- Import translations. DO NOT MERGE ANYWHERE · 3903b6a8
  Bill Yi authored 1 year ago
  
  Auto-generated-cl: translation import Change-Id: I11230cbc42169189ed17c178d1d9f3345a68cef7
  3903b6a8
May 07, 2023
- Merge "Fix 2 OOB bugs in LeAudioBroadcasterImpl::UpdateMetadata" into tm-qpr-dev · b52a8e43
  Hui Peng authored 1 year ago
  
  b52a8e43
May 06, 2023

Merge "Fix an OOB bug in parameters_response_parser" into tm-dev am: am: · 6032ec4d

Hui Peng authored 1 year ago

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/22948054

Change-Id: Ia18f2a3bf30dcba13e9e8a60596884019e3af094
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

6032ec4d

Merge "Fix an OOB bug in parameters_response_parser" into tm-dev am: · 922ca83e

Hui Peng authored 1 year ago

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/22948054

Change-Id: I06c0347f1edc9a229ed7b926a6b8aa1d7151eee6
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

922ca83e

Merge "Fix an OOB bug in parameters_response_parser" into tm-dev · d2e98455
Hui Peng authored 1 year ago

d2e98455

May 05, 2023
- Merge "disable AT+ANDROID processing for wear" into tm-qpr-dev · 5cbbd48a
  Thomas Girardier authored 1 year ago
  
  5cbbd48a
- Fix 2 OOB bugs in LeAudioBroadcasterImpl::UpdateMetadata · 5f4fa4a0
  Hui Peng authored 1 year ago
  
  Bug: 275551881 Test: manual Ignore-AOSP-First: security Tag: #security Merged-In: I6172d11a9c745018ca40e2df8b0e70f4f9728fde Change-Id: I6172d11a9c745018ca40e2df8b0e70f4f9728fde
  5f4fa4a0
May 04, 2023
- Merge "Import translations. DO NOT MERGE ANYWHERE" into tm-qpr-dev · e3875d07
  Bill Yi authored 1 year ago
  
  e3875d07
- disable AT+ANDROID processing for wear · c487f626
  Yuyang Huang authored 1 year ago
  
  Test: manual Bug: 275668166 (cherry picked from https://android-review.googlesource.com/q/commit:86461f427e8f13b08e89a31c6a707db48b9456b4) Merged-In: Ifd2893abedcb181e67c1de8d6d6a8dfa38381696 Change-Id: Ifd2893abedcb181e67c1de8d6d6a8dfa38381696
  c487f626
- Merge "Import translations. DO NOT MERGE ANYWHERE" into tm-qpr-dev · 986b3f21
  Treehugger Robot authored 1 year ago
  
  986b3f21