- May 24, 2023
-
-
Brian Delwiche authored
Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/21609715 Change-Id: I8706187fb778ea1ca35291b08773fb52181dc335 Signed-off-by:
Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
-
Brian Delwiche authored
-
- May 19, 2023
-
-
Brian Delwiche authored
Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/22726306 Change-Id: I5dc67f531b235302c6bf8904609af1d7e0d869b9 Signed-off-by:
-
- May 18, 2023
-
-
Brian Delwiche authored
-
- May 17, 2023
-
-
Hui Peng authored
Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/23152778 Change-Id: I0d6c9381f451aba707f54c1da27319b5ee097a0d Signed-off-by:
-
- May 16, 2023
-
-
Hui Peng authored
Bug: 280633699 Test: manual Ignore-AOSP-First: security Tag: #security Change-Id: Iaa4d603921fc4ffb8cfb5783f99ec0963affd6a2
-
Brian Delwiche authored
Local variables tracking structure size in build_read_multi_rsp are of uint16 type but accept a full uint16 range from function arguments while appending a fixed-length offset. This can lead to an integer overflow and unexpected behavior. Change the locals to size_t, and add a check during reasssignment. Bug: 273966636 Test: atest bluetooth_test_gd_unit, net_test_stack_btm Tag: #security Ignore-AOSP-First: Security Change-Id: I3a74bdb0d003cb6bf4f282615be8c68836676715 (cherry picked from commit 70a4d628)
-
Hui Peng authored
Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/23139401 Change-Id: I7c10e2ad52871e80aedb37b65500498fe494908f Signed-off-by:
-
- May 15, 2023
-
-
Hui Peng authored
-
- May 13, 2023
-
-
Hui Peng authored
Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/23152794 Bug: 271335899 Test: manual Ignore-AOSP-First: security Tag: #security Merged-In: Ia06c9a17f2daa5ce4c32cffa536777f47774cf31 Change-Id: I02f1aec42e0c12c8f53fe03090b0c40c6e8e51c5 Signed-off-by:
-
- May 12, 2023
-
-
Hui Peng authored
The tx mtu in EATT can be controlled by remote device. With malicious mtu values, it is possible to trigger integer overflow and OOB write at multiple places (see the bug below). This fix enforces a max tx mtu in EATT. Bug: 271335899 Test: manual Ignore-AOSP-First: security Tag: #security Merged-In: Ia06c9a17f2daa5ce4c32cffa536777f47774cf31 Change-Id: Ia06c9a17f2daa5ce4c32cffa536777f47774cf31
-
- May 10, 2023
-
-
Hui Peng authored
Bug: 278279023 Test: manual Ignore-AOSP-First: security Tag: #security Change-Id: I6727c9a071170baadb2292daa52f71190972ecca
-
Treehugger Robot authored
Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/22940765 Change-Id: Ib3381da1f681834da0be152053e92a5944269f65 Signed-off-by:
-
- May 09, 2023
-
-
Treehugger Robot authored
-
- May 06, 2023
-
-
Hui Peng authored
Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/22948054 Change-Id: I06c0347f1edc9a229ed7b926a6b8aa1d7151eee6 Signed-off-by:
-
Hui Peng authored
-
- May 04, 2023
-
-
Hui Peng authored
Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/22900658 Change-Id: I4d8458d008c180a0144496e358bcd5c7ca0a9058 Signed-off-by:
-
- May 03, 2023
-
-
Hui Peng authored
Bug: 260726311 Test: manual Ignore-AOSP-First: security Tag: #security Change-Id: I199fdd0651ebc29f130ebb5f5fa07e13f22a7d37
-
- Apr 30, 2023
-
-
Hui Peng authored
tBTA_AV_CI_SETCONFIG is treated as tBTA_AV_STR_MSG in bta_av_setconfig_rej, resulting OOB access. Bug: 260230151 Test: manual Ignore-AOSP-First: security Tag: #security Merged-In: I78a1ee50dea0113381e51f8521711d758dc759cf Change-Id: I78a1ee50dea0113381e51f8521711d758dc759cf
-
- Apr 29, 2023
-
-
Hui Peng authored
Bug: 266433017 Test: manual Ignore-AOSP-First: security Tag: #security Change-Id: I4a8959ac6e5980a6c6d20edcf103482b9916656a
-
- Apr 26, 2023
-
-
Hui Peng authored
Merge "Fix a potential OOB in BleAdvertiserVscHciInterfaceImpl::VendorSpecificEventCback" into tm-dev am: c2166e96 Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/20918444 Change-Id: I5b1c3e5df0292e188cab8c710abfae3c212fe788 Signed-off-by:
-
Hui Peng authored
Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/22697261 Change-Id: I659be20b850ae5ae04a88750098e9b2e467873a3 Signed-off-by:
-
Hui Peng authored
Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/22696389 Change-Id: Ia34bf0a351597361ba3663a0b54c8efeade47c86 Signed-off-by:
-
Hui Peng authored
Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/22696394 Change-Id: If13ec5c92cdbb18fc5adca6697de1fbd05b18e7f Signed-off-by:
-
- Apr 25, 2023
-
-
Hui Peng authored
Merge "Fix a potential OOB in BleAdvertiserVscHciInterfaceImpl::VendorSpecificEventCback" into tm-dev
-
Hui Peng authored
-
Hui Peng authored
-
Hui Peng authored
-
Treehugger Robot authored
Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/22605431 Change-Id: I697456facafd7b447f50ab0a5b56cf4b823cf10a Signed-off-by:
-
Treehugger Robot authored
-
- Apr 18, 2023
-
-
Hui Peng authored
Plus move macros used in struct bt_oob_data_s to bluetooth.h Bug: 274722185 Test: manual Ignore-AOSP-First: security Tag: #security Change-Id: Ie12feb4090a1eb88f5c9e097546f55a076839fb0
-
Hui Peng authored
Bug: 276975913 Test: manual Ignore-AOSP-First: security Tag: security Change-Id: I38353a573168e18f06b2b311e532a937044fd92f
-
Hui Peng authored
Bug: 274722163 Test: manual Ignore-AOSP-First: security Tag: #security Change-Id: Ie4b30bbc19ba0bd191839af35880a4831d8005b1
-
- Apr 14, 2023
-
-
William Escande authored
Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/22625319 Change-Id: I0c20a4b17a0b6d0fdedf9887b70de0b8b0324b5b Signed-off-by:
-
William Escande authored
-
Hui Peng authored
This CL fixes the following 3 bugs: 1. Integer underflow triggered by malicious MTU from peer device 2. Integer overflow caused by maliciously long item names 3. Bug caused by typo: item_len_left -> attribute_len_left Bug: 242994452 Tag: #security Ignore-AOSP-First: security Test: manual Change-Id: I0d2af48b7eb3469d9d1923910e4facc8f2cdbc95
-
- Apr 13, 2023
-
-
- Apr 04, 2023
-
-
Timothy Yiu authored
Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/22316109 Change-Id: I40d67db13aae24e9093615e1663483f97e874b08 Signed-off-by:
-
Timothy Yiu authored
-
- Apr 03, 2023
-
-
Brian Delwiche authored
Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/20697203 Change-Id: Ie634b4e628a94fd90cfe9b78ba71441217501139 Signed-off-by:
-
