Security Patches :D#1

Open

Megh-Rana wants to merge 31 commits intoCorvus-AOSP:11from

CorvusOS-Revived:11

Commits on May 17, 2023

osi: Prevent memory allocations with MSB set

Chris Manton
authored and
Megh-Rana
committed
security: Use-After-Free in btm_sec_[dis]connected

Chris Manton
authored and
Megh-Rana
committed
Reset the IRK after all devices are unpaired

goptedoblivion
authored and
Megh-Rana
committed

Commits on May 19, 2023

Security fix OOB read due to invalid count in stack/avrc/avrc_pars_ct

Ted Wang
authored and
Megh-Rana
committed
Security: Fix out of bound write in HFP client

Chen Chen
authored and
Megh-Rana
committed
Check Avrcp packet vendor length before extracting length

wescande
authored and
Megh-Rana
committed
Security: Fix out of bound read in AT_SKIP_REST

zxzxwu
authored and
Megh-Rana
committed
Removing bonded device when auth fails due to missing keys

Roopa Sattiraju
authored and
Megh-Rana
committed
Fix potential interger overflow when parsing vendor response

Ted Wang
authored and
Megh-Rana
committed
Add negative length check in process_service_search_rsp

Brian Delwiche
authored and
Megh-Rana
committed
Add buffer in pin_reply in bluetooth.cc

Brian Delwiche
authored and
Megh-Rana
committed
Add length check when copy AVDTP packet

Ted Wang
authored and
Megh-Rana
committed
RESTRICT AUTOMERGE Added max buffer length check

Brian Delwiche
authored and
Megh-Rana
committed
Add missing increment in bnep_api.cc

Brian Delwiche
authored and
Megh-Rana
committed
Add length check when copy AVDT and AVCT packet

ek9852
authored and
Megh-Rana
committed
Fix integer overflow when parsing avrc response

ek9852
authored and
Megh-Rana
committed

Commits on May 20, 2023

Report failure when not able to connect to AVRCP

Brian Delwiche
authored and
Megh-Rana
committed
Add bounds check in avdt_scb_act.cc

Brian Delwiche
authored and
Megh-Rana
committed
Fix an OOB Write bug in gatt_check_write_long_terminate

benquike
authored and
Megh-Rana
committed
Fix an OOB access bug in A2DP_BuildMediaPayloadHeaderSbc

benquike
authored and
Megh-Rana
committed
Fix an OOB write in SDP_AddAttribute

benquike
authored and
Megh-Rana
committed
Fix OOB access in avdt_scb_hdl_pkt_no_frag

benquike
authored and
Megh-Rana
committed
Fix an OOB bug in register_notification_rsp

benquike
authored and
Megh-Rana
committed

Commits on Jun 12, 2023

Prevent use-after-free of HID reports

Brian Delwiche
authored and
Megh-Rana
committed
Revert "Revert "[RESTRICT AUTOMERGE] Validate buffer length in sdpu_build_uuid_seq""

Brian Delwiche
authored and
Megh-Rana
committed
Revert "Revert "Fix wrong BR/EDR link key downgrades (P_256->P_192)""

Brian Delwiche
authored and
Megh-Rana
committed

Commits on Jul 10, 2023

Fix gatt_end_operation buffer overflow

tyiu-google
authored and
Megh-Rana
committed

Commits on Feb 14, 2024

Fix an integer overflow bug in avdt_msg_asmbl

benquike
authored and
Megh-Rana
committed
Fix integer overflow in build_read_multi_rsp

Brian Delwiche
authored and
Megh-Rana
committed
Fix potential abort in btu_av_act.cc

Brian Delwiche
authored and
Megh-Rana
committed
Fix UAF in gatt_cl.cc

Brian Delwiche
authored and
Megh-Rana
committed