diff options
| author | Hansong Zhang <hsz@google.com> | 2019-01-09 18:18:17 -0800 |
|---|---|---|
| committer | Tim Schumacher <timschumi@gmx.de> | 2019-07-07 14:40:23 +0200 |
| commit | 3d34ee18a6b5e16ddf77157103a1c3cc5a777d3b (patch) | |
| tree | b614615cd8d4a2969b58cbe165096485cedd350d | |
| parent | 1ce2f0f57ce8d450ff16c177f51304b3d3736319 (diff) | |
| download | android_system_bt-3d34ee18a6b5e16ddf77157103a1c3cc5a777d3b.tar.gz android_system_bt-3d34ee18a6b5e16ddf77157103a1c3cc5a777d3b.tar.bz2 android_system_bt-3d34ee18a6b5e16ddf77157103a1c3cc5a777d3b.zip | |
btm_proc_smp_cback: Don't access p_dev_rec if freed
In btm_proc_smp_cback(), return after p_dev_rec is freed in the middle
to prevent use after free
Bug: 120612744
Test: Use ASAN build; connect to a LE device and wait for timeout
Change-Id: Ic9d0eaeb62a1a1b24884146ca82f4104fabc5bac
(cherry picked from commit 953dd279502980b1d8d30656eb78c6445a6e31f7)
| -rw-r--r-- | stack/btm/btm_ble.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/stack/btm/btm_ble.c b/stack/btm/btm_ble.c index bcabc3428..0a5003d21 100644 --- a/stack/btm/btm_ble.c +++ b/stack/btm/btm_ble.c @@ -34,6 +34,7 @@ #include "btm_int.h" #include "btm_ble_api.h" #include "smp_api.h" +#include "log/log.h" #include "l2c_int.h" #include "gap_api.h" #include "bt_utils.h" @@ -2034,6 +2035,12 @@ UINT8 btm_proc_smp_cback(tSMP_EVT event, BD_ADDR bd_addr, tSMP_EVT_DATA *p_data) if (event == SMP_COMPLT_EVT) { + p_dev_rec = btm_find_dev(bd_addr); + if (p_dev_rec == NULL) { + BTM_TRACE_ERROR("%s: p_dev_rec is NULL", __func__); + android_errorWriteLog(0x534e4554, "120612744"); + return 0; + } BTM_TRACE_DEBUG ("evt=SMP_COMPLT_EVT before update sec_level=0x%x sec_flags=0x%x", p_data->cmplt.sec_level , p_dev_rec->sec_flags ); res = (p_data->cmplt.reason == SMP_SUCCESS) ? BTM_SUCCESS : BTM_ERR_PROCESSING; |