Merge tag 'android-8.1.0_r70' into staging/lineage-15.1_merge-android-8.1.0_r70lineage-15.1

Android 8.1.0 release 70

* tag 'android-8.1.0_r70':
  AdapterService: Check the PIN code length before using
  DO NOT MERGE Separate SDP procedure from bonding state (2/2)
  Revert "DO NOT MERGE Separate SDP procedure from bonding state (2/2)"

Change-Id: I5a1d0950b2d41812a6692d1e1dfaedfedeb6f5e8

1 files changed, 10 insertions, 0 deletions

diff --git a/src/com/android/bluetooth/btservice/AdapterService.java b/src/com/android/bluetooth/btservice/AdapterService.java
index a2a675fb9..a7ff901be 100644
--- a/src/com/android/bluetooth/btservice/AdapterService.java
+++ b/src/com/android/bluetooth/btservice/AdapterService.java
@@ -1727,6 +1727,11 @@ public class AdapterService extends Service {
             return false;
         }
 
+        if (pinCode.length != len) {
+            EventLog.writeEvent(0x534e4554, "139287605", -1, "PIN code length mismatch");
+            return false;
+        }
+
         byte[] addr = Utils.getBytesFromAddress(device.getAddress());
         return pinReplyNative(addr, accept, len, pinCode);
     }
@@ -1738,6 +1743,11 @@ public class AdapterService extends Service {
             return false;
         }
 
+        if (passkey.length != len) {
+            EventLog.writeEvent(0x534e4554, "139287605", -1, "Passkey length mismatch");
+            return false;
+        }
+
         byte[] addr = Utils.getBytesFromAddress(device.getAddress());
         return sspReplyNative(addr, AbstractionLayer.BT_SSP_VARIANT_PASSKEY_ENTRY, accept,
                 Utils.byteArrayToInt(passkey));