1166587 - Check OBEX packet length before accessing it

Status: RESOLVED FIXED

(Firefox OS Graveyard :: Bluetooth, defect)

Description

[Ben Tian (inactive)]

+++ This bug was initially created as a clone of Bug #1162902 +++

Bug #1162902 comment 7 mentions OBEX packet length problem we should check for both OPP and PBAP managers.

Create this bug to fix them:
- ensure received packet length smaller than max packet length
- ensure received packet length equals to or larger than we expect for different opcodes.

Comment 1

[Ben Tian (inactive)]

Attachment: Patch 1 (v1): Check OBEX packet length before accessing it

Comment 2

[Shawn Huang [:shawnjohnjr][:shuang] (as a happy gecko contributor)]

Comment on attachment 8607952 [details] [diff] [review]
Patch 1 (v1): Check OBEX packet length before accessing it

Review of attachment 8607952 [details] [diff] [review]:
-----------------------------------------------------------------

The code looks good to me. Thanks, Ben!

Comment 3

[Ben Tian (inactive)]

try fails to build on ICS emulator for lack of BlueZ OPP manger change. I'll add BlueZ OPP change into the patch.

https://treeherder.mozilla.org/#/jobs?repo=try&revision=f246c2a123ce

Comment 4

[Ben Tian (inactive)]

Attachment: [final] Patch 1: Check OBEX packet length before accessing it, r=shuang

Attach revised patch with successful try result.
https://treeherder.mozilla.org/#/jobs?repo=try&revision=69554945647e

Comment 5

[Pulsebot]

https://hg.mozilla.org/integration/b2g-inbound/rev/fbeefb82d466

Comment 6

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/fbeefb82d466

Comment 7

[Jamin Liu [:jaliu][:Jamin]]

Hi Ben,
According to Bug #1162902 comment 7, the patch prevents the invalid memory access.
Since Bug 1162902 had been landed to 2.2r, we might consider landing this patch to 2.2r too.
What do you think ?

Comment 8

[Ben Tian (inactive)]

Set 2.2r+ blocker per comment 7.

Comment 9

[Will Wang [:WillWang]]

Attachment: (for branch 2.2r) Patch 1: Check OBEX packet length before accessing it, r=shuang

Rebased patch for branch 2.2r.
Carry r+ from previous patch.

Comment 10

[Will Wang [:WillWang]]

Attachment: (for branch 2.2r) Patch 2: Check OBEX packet length before accessing it

Second rebased patch for 2.2r, for the related function call in BluetoothMapSmsManager.cpp.

Hi Shawn,
Since I am currently not familiar with MAP profile,
could you help to review for this slight modification?

Thanks!

Comment 11

[Carsten Book [:Tomcat]]

  https://hg.mozilla.org/releases/mozilla-b2g37_v2_2r/rev/ee98f6b5eb10
   https://hg.mozilla.org/releases/mozilla-b2g37_v2_2r/rev/9e345b193452