system-bt

Fork

Merge "Fix potential OOB when parsing inquiry results" into qt-qpr1-dev

Merge "VSC batch scan: Check packet length" into qt-qpr1-dev

L2CAP: Check length for packet before connection complete

Bug: 141745011
Test: Run POC
Change-Id: I9dc27521fa2e7f6ea345ec65dc9d3e873d71ef0f

VSC batch scan: Check packet length

Bug: 142543524
Test: POC
Merged-In: I32633d5e6dfdd17b00d468cfd29ad081ae91f0e4
Change-Id: I32633d5e6dfdd17b00d468cfd29ad081ae91f0e4

Merge changes from topic "NIAP_patch" into qt-qpr1-dev

* changes:
DO NOT MERGE: NIAP: Use AES-GCM 256 bits to encrypt key.
DO NOT MERGE: NIAP: Use keystore to encrypt KEY

Snap for 6087694 from 7e0b7d04688aafc192b579ba11868ee6bd0cf33c to qt-qpr2-release

Change-Id: I8e3dc07f7580b30b6ae73e13528d21bcd6ae2a2c

L2CAP: Bounds check num_handles in NumCompletedPackets

Bug: 141617601
Test: Pair and connect
Change-Id: I1a8ff39f677c6957e99a4d3cbd278720dd273a83
(cherry picked from commit 2506db7d01939b286e34e404b80a73e6f4dc8593)

HCI: Check length of connection complete event

Fixes: 141619686
Test: Pair and connect
Change-Id: Ib15d6a8cbb8c6a7404bf1afa023277429029867d
(cherry picked from commit 7ee6458cf4939ad78dbebd70c2520ad56c31f4a9)

Fix potential OOB when parsing inquiry results

Bug: 141620271
Change-Id: I30c7558b1ae1a77d0004760ef831480347a06e11
(cherry picked from commit c44516749af81bc5fc79afc0772f42bf0ec37bd4)

Merge "Handle BQR root inflammation event" into qt-qpr1-dev

Handle BQR root inflammation event

* When Bluetooth process recieves BQR root inflammation event, wait
5 seconds for possible DEBUG_INFO events, then abort.
* Fix the DEBUG_INFO not working problem.
* Do not immediately abort when HAL service dies if abort_timer has
already started, so we won't interrupt log collecting procedure.

Bug: 145568772
Bug: 144572644
Bug: 144592765
Test: Manual
Change-Id: Ibe6c341a3e9aabec33de8d3f90c4a6a3403d06bc
Merged-In: Ibe6c341a3e9aabec33de8d3f90c4a6a3403d06bc

DO NOT MERGE: NIAP: Use AES-GCM 256 bits to encrypt key.

use AES-GCM 256 bits to encrypt key.

Bug: 140483038
Test: NA
Change-Id: Ie5e85edf4fd8dbd9120ea383fd3b9214b6026816

DO NOT MERGE: NIAP: Use keystore to encrypt KEY

Encrypt Classic and LE key via kerstore.

Bug: 140483038
Test: Manual
- Pair a device after OOBE
- adb shell settings put global niap_mode 1
- Re-enable Bluetooth
- Ensured that the Key was read correctly
- Ensured that the Key was encrypted when stored on disk

Change-Id: I6ece990135fb0a16eef3ecf6508ca759eee2c4c6

Fix potential OOB write in btm_read_remote_ext_features_complete

Add event length check to avoid hci event sent from controller not
correct.
Add page number check to avoid page number is bigger than
HCI_EXT_FEATURES_PAGE_MAX.

Bug: 141552859
Bug: 144205318
Test: inject function
Merged-In: Iaca4db4ee9bf27362f62aba0da088727e98955d1
Change-Id: Iaca4db4ee9bf27362f62aba0da088727e98955d1
(cherry picked from commit 140d8297ace9cd54a903a9cd3a079fd805030f1e)

GAP: Correct the continuous pkt length in l2cap

L2cap continuous pkt length wrongly calculated in
reassembly logic when remote sends more data
than expected.

Wrong pkt length leading to memory corruption

Hence the Correct the continuous pkt length in
l2cap reassembly logic.

Bug: 135239489
Bug: 143894715
CRs-Fixed: 2434229
Test: make and internal testing
Change-Id: I758d9e31465b99e436b9b1841320000f08186c97
Merged-In: I758d9e31465b99e436b9b1841320000f08186c97
(cherry picked from commit 337bd4579453bd6bf98ff519de3ac1019cd30d28)
(cherry picked from commit 602f4b44fe30ec8b225e1cee5f96817607d93e5a)

Fix potential OOB write in btm_read_remote_ext_features_complete

Add event length check to avoid hci event sent from controller not
correct.
Add page number check to avoid page number is bigger than
HCI_EXT_FEATURES_PAGE_MAX.

Bug: 141552859
Bug: 144205318
Test: inject function
Merged-In: Iaca4db4ee9bf27362f62aba0da088727e98955d1
Change-Id: Iaca4db4ee9bf27362f62aba0da088727e98955d1
(cherry picked from commit 6dfae174853e0c49f36362e59a2c7ca607f01cf9)

GAP: Correct the continuous pkt length in l2cap

L2cap continuous pkt length wrongly calculated in
reassembly logic when remote sends more data
than expected.

Wrong pkt length leading to memory corruption

Hence the Correct the continuous pkt length in
l2cap reassembly logic.

Bug: 135239489
Bug: 143894715
CRs-Fixed: 2434229
Test: make and internal testing
Change-Id: I758d9e31465b99e436b9b1841320000f08186c97
Merged-In: I758d9e31465b99e436b9b1841320000f08186c97
(cherry picked from commit 337bd4579453bd6bf98ff519de3ac1019cd30d28)
(cherry picked from commit 602f4b44fe30ec8b225e1cee5f96817607d93e5a)

Snap for 6049975 from a6a11e2bb9eaa952a9757042ff7c805efb327d03 to qt-qpr2-release

Change-Id: I45ce6df67738a25e73b52d7d88b60948193b5a9b

[automerger skipped] Merge "Fix potential OOB write in btm_read_remote_ext_features_complete" into oc-mr1-dev am: 561bf0a604 -s ours am: ad6365c078 -s ours am: d0afd04b43 -s ours am: 81882c385d -s ours
am skip reason: Change-Id Iaca4db4ee9bf27362f62aba0da088727e98955d1 with SHA-1 291307f66c is in history

Change-Id: I0724d8046c8f5c53d5284a7fbf294acf25172d43

[automerger skipped] Merge "Fix potential OOB write in btm_read_remote_ext_features_complete" into oc-dev am: 2039ca38e9 am: 5b85308108 am: 477e110c07 -s ours am: 45d039f2bc -s ours am: d8bf9a6516 -s ours am: 58a17c1e7f -s ours
am skip reason: Change-Id Iaca4db4ee9bf27362f62aba0da088727e98955d1 with SHA-1 291307f66c is in history

Change-Id: If8b5e513ee4e041254b6bde0a415f23c7167e955

[automerger skipped] Merge "Fix potential OOB write in btm_read_remote_ext_features_complete" into qt-dev am: 40a52c224f -s ours am: 818467c30d -s ours
am skip reason: Change-Id Iaca4db4ee9bf27362f62aba0da088727e98955d1 with SHA-1 140d8297ac is in history

Change-Id: If5e64421b909b65df488489c03023f5c5b89f7bf

[automerger skipped] Merge "Fix potential OOB write in btm_read_remote_ext_features_complete" into oc-mr1-dev am: 561bf0a604 -s ours am: ad6365c078 -s ours am: d0afd04b43 -s ours
am skip reason: Change-Id Iaca4db4ee9bf27362f62aba0da088727e98955d1 with SHA-1 291307f66c is in history

Change-Id: I2d70a9464106f5b271c072a88f8717d6802955b0

[automerger skipped] Merge "Fix potential OOB write in btm_read_remote_ext_features_complete" into oc-dev am: 2039ca38e9 am: 5b85308108 am: 477e110c07 -s ours am: 45d039f2bc -s ours am: d8bf9a6516 -s ours
am skip reason: Change-Id Iaca4db4ee9bf27362f62aba0da088727e98955d1 with SHA-1 291307f66c is in history

Change-Id: I60dc5b1a01024e46318fc710e265c28fa5efeeb8

[automerger skipped] Merge "Fix potential OOB write in btm_read_remote_ext_features_complete" into qt-dev am: 40a52c224f -s ours
am skip reason: Change-Id Iaca4db4ee9bf27362f62aba0da088727e98955d1 with SHA-1 140d8297ac is in history

Change-Id: I53f83d0fa0fd712160e2cba5957b8e8dd0204711

[automerger skipped] Merge "Fix potential OOB write in btm_read_remote_ext_features_complete" into oc-mr1-dev am: 561bf0a604 -s ours am: ad6365c078 -s ours
am skip reason: Change-Id Iaca4db4ee9bf27362f62aba0da088727e98955d1 with SHA-1 291307f66c is in history

Change-Id: I872656ceacaa6387b21773a44ca2a55783dc4e37

[automerger skipped] Merge "Fix potential OOB write in btm_read_remote_ext_features_complete" into oc-dev am: 2039ca38e9 am: 5b85308108 am: 477e110c07 -s ours am: 45d039f2bc -s ours
am skip reason: Change-Id Iaca4db4ee9bf27362f62aba0da088727e98955d1 with SHA-1 291307f66c is in history

Change-Id: I3a0c05b891878f12bb242007e589652e960a90e1

Merge "Fix potential OOB write in btm_read_remote_ext_features_complete" into qt-dev

[automerger skipped] Merge "Fix potential OOB write in btm_read_remote_ext_features_complete" into oc-mr1-dev am: 561bf0a604 -s ours
am skip reason: Change-Id Iaca4db4ee9bf27362f62aba0da088727e98955d1 with SHA-1 b4e8a17daa is in history

Change-Id: Iab0bb64fa4b03ea97330346476993a4812802264

[automerger skipped] Merge "Fix potential OOB write in btm_read_remote_ext_features_complete" into pi-dev am: 7f3b214ec9 am: 5f1bca6b9a am: 954bbdc172 -s ours
am skip reason: Change-Id Iaca4db4ee9bf27362f62aba0da088727e98955d1 with SHA-1 2aa92f871c is in history

Change-Id: I66dbc18fe8af551249eb493de070d5e64bb01bfd

[automerger skipped] Merge "Fix potential OOB write in btm_read_remote_ext_features_complete" into oc-dev am: 2039ca38e9 am: 5b85308108 am: 477e110c07 -s ours
am skip reason: Change-Id Iaca4db4ee9bf27362f62aba0da088727e98955d1 with SHA-1 140d8297ac is in history

Change-Id: I818670e4df7c0d3b8d401fa8f6152aea39a412f1