From faee9ea49d7651f2b3347d0b896552b06f6c7f52 Mon Sep 17 00:00:00 2001 From: Jin Cheng Date: Tue, 14 Jul 2026 07:40:08 +0800 Subject: [PATCH] fix(bt/bluedroid): fixed possible 1-byte OOB read in bta_hh_ctrl_dat_act Closes SEC-786 --- .../bt/host/bluedroid/bta/hh/bta_hh_act.c | 29 +++++++++++++++++-- 1 file changed, 26 insertions(+), 3 deletions(-) diff --git a/components/bt/host/bluedroid/bta/hh/bta_hh_act.c b/components/bt/host/bluedroid/bta/hh/bta_hh_act.c index 7addc2f41db..8a7725fa300 100644 --- a/components/bt/host/bluedroid/bta/hh/bta_hh_act.c +++ b/components/bt/host/bluedroid/bta/hh/bta_hh_act.c @@ -731,9 +731,20 @@ void bta_hh_handsk_act(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA *p_data) *******************************************************************************/ void bta_hh_ctrl_dat_act(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA *p_data) { - BT_HDR *pdata = p_data->hid_cback.p_data; - UINT8 *data = (UINT8 *)(pdata + 1) + pdata->offset; - tBTA_HH_HSDATA hs_data; + BT_HDR *pdata = NULL; + UINT8 *data = NULL; + tBTA_HH_HSDATA hs_data = {0}; + + if (p_cb == NULL) { + return; + } + + if (p_data == NULL || (pdata = p_data->hid_cback.p_data) == NULL) { + APPL_TRACE_ERROR("NULL ctrl data %p,%p for w4_evt=%d", p_data, pdata, p_cb->w4_evt); + hs_data.status = BTA_HH_ERR; + hs_data.handle = p_cb->hid_handle; + goto _exit; + } #if BTA_HH_DEBUG APPL_TRACE_DEBUG("Ctrl DATA received w4: event[%s]", @@ -741,15 +752,26 @@ void bta_hh_ctrl_dat_act(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA *p_data) #endif hs_data.status = BTA_HH_OK; hs_data.handle = p_cb->hid_handle; + data = (UINT8 *)(pdata + 1) + pdata->offset; switch (p_cb->w4_evt) { case BTA_HH_GET_IDLE_EVT: + if (pdata->len < 1) { + APPL_TRACE_ERROR("GET_IDLE with insufficient length %u", pdata->len); + hs_data.status = BTA_HH_ERR; + break; + } hs_data.rsp_data.idle_rate = *data; break; case BTA_HH_GET_RPT_EVT: hs_data.rsp_data.p_rpt_data = pdata; break; case BTA_HH_GET_PROTO_EVT: + if (pdata->len < 1) { + APPL_TRACE_ERROR("GET_PROTO with insufficient length %u", pdata->len); + hs_data.status = BTA_HH_ERR; + break; + } /* match up BTE/BTA report/boot mode def*/ hs_data.rsp_data.proto_mode = ((*data) == HID_PAR_PROTOCOL_REPORT) ? \ BTA_HH_PROTO_RPT_MODE : BTA_HH_PROTO_BOOT_MODE; @@ -777,6 +799,7 @@ void bta_hh_ctrl_dat_act(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA *p_data) bta_sys_busy(BTA_ID_HH, p_cb->app_id, p_cb->addr); bta_sys_idle(BTA_ID_HH, p_cb->app_id, p_cb->addr); +_exit: (* bta_hh_cb.p_cback)(p_cb->w4_evt, (tBTA_HH *)&hs_data); p_cb->w4_evt = 0;