Evolution-x/hardware_interfaces
1
0
Fork 0
mirror of https://github.com/Evolution-X/hardware_interfaces synced 2026-02-01 16:50:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix null dereference read in android::hardware::bluetooth::hci::H4Protocol::Send

Browse Source 
Bug: 276375037
Test: atest VtsHalBluetoothTargetTest
Change-Id: Ib9f99a75a97538899ac64a3c02fff1ec5804a0e6
This commit is contained in:
Elie Kheirallah
2023-04-14 17:49:42 +00:00
parent fe4b88ab73
commit cd1bf1e530
2 changed files with 23 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
bluetooth/aidl/default/BluetoothHci.cpp
View File

@@ -176,7 +176,10 @@ void BluetoothHci::reset() {
mFdWatcher.WatchFdForNonBlockingReads(mFd,
[this](int) { mH4->OnDataReady(); });
send(PacketType::COMMAND, reset);
ndk::ScopedAStatus result = send(PacketType::COMMAND, reset);
if (!result.isOk()) {
ALOGE("Error sending reset command");
}
auto status = resetFuture.wait_for(std::chrono::seconds(1));
mFdWatcher.StopWatchingFileDescriptors();
if (status == std::future_status::ready) {
@@ -303,30 +306,35 @@ ndk::ScopedAStatus BluetoothHci::close() {
ndk::ScopedAStatus BluetoothHci::sendHciCommand(
const std::vector<uint8_t>& packet) {
send(PacketType::COMMAND, packet);
return ndk::ScopedAStatus::ok();
return send(PacketType::COMMAND, packet);
}
ndk::ScopedAStatus BluetoothHci::sendAclData(
const std::vector<uint8_t>& packet) {
send(PacketType::ACL_DATA, packet);
return ndk::ScopedAStatus::ok();
return send(PacketType::ACL_DATA, packet);
}
ndk::ScopedAStatus BluetoothHci::sendScoData(
const std::vector<uint8_t>& packet) {
send(PacketType::SCO_DATA, packet);
return ndk::ScopedAStatus::ok();
return send(PacketType::SCO_DATA, packet);
}
ndk::ScopedAStatus BluetoothHci::sendIsoData(
const std::vector<uint8_t>& packet) {
send(PacketType::ISO_DATA, packet);
return send(PacketType::ISO_DATA, packet);
}
ndk::ScopedAStatus BluetoothHci::send(PacketType type,
const std::vector<uint8_t>& v) {
if (mH4 == nullptr) {
return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_STATE);
}
if (v.empty()) {
ALOGE("Packet is empty, no data was found to be sent");
return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_ARGUMENT);
}
mH4->Send(type, v);
return ndk::ScopedAStatus::ok();
}
void BluetoothHci::send(PacketType type, const std::vector<uint8_t>& v) {
mH4->Send(type, v);
}
} // namespace aidl::android::hardware::bluetooth::impl

5
bluetooth/aidl/default/BluetoothHci.h
View File

@@ -66,8 +66,9 @@ class BluetoothHci : public BnBluetoothHci {
::android::hardware::bluetooth::async::AsyncFdWatcher mFdWatcher;
int getFdFromDevPath();
void send(::android::hardware::bluetooth::hci::PacketType type,
const std::vector<uint8_t>& packet);
[[nodiscard]] ndk::ScopedAStatus send(
::android::hardware::bluetooth::hci::PacketType type,
const std::vector<uint8_t>& packet);
std::unique_ptr<NetBluetoothMgmt> management_{};
// Send a reset command and discard all packets until a reset is received.