Fix error reporting for SDP Requests
v2 cover Fix error reporting for SDP Requests
Fixed the following issues revealed while performing bluez qualification:
- Incorrect error code was being reported for requests with invalid PDU size;
- No error was being reported if a request less than 0x07 was received.
--
Angela Bartholomaus
Sent by an employee of the Qualcomm Innovation Center, Inc. The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum.
PATCH v2 1/4 Bluetooth: Send an Invalid PDU Size Error Response for Service Search Req
Send error code 0x04 per CoreSpecv2.1, sec 4.4 for TP/SERVER/SS/BI-01-C
--- src/sdpd-request.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
src/sdpd-request.c +1 -1
@@ -367,7 +367,7 @@ static int service_search_req(sdp_req_t *req, sdp_buf_t *buf) mlen = scanned +sizeof (uint16_t ) +1 ;// ensure we don't read past buffer if (plen < mlen || plen != mlen + *(uint8_t *)(pdata+sizeof (uint16_t ))) { - status =SDP_INVALID_SYNTAX ; + status =SDP_INVALID_PDU_SIZE ; goto done; }
Signature · 5 lines
1.7.2.2 -- Angela Bartholomaus Sent by an employee of the Qualcomm Innovation Center, Inc. The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum.
Re: [PATCH 1/4] Bluetooth: Send an Invalid PDU Size Error Response for Service Search Req
Hi Angela,
Quoted 10 lines · Angela Bartholomaus
Send error code
0x04per CoreSpecv2.1, sec 4.4 for TP/SERVER/SS/BI-01-C--- src/sdpd-request.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)src/sdpd-request.c +0
-0
src/sdpd-request.c static int service_search_req(sdp_req_t *req, sdp_buf_t *buf) · line 372
Quoted 7 lines
src/sdpd-request.c +1
-1@@ -367,7 +367,7 @@ static int service_search_req(sdp_req_t *req, sdp_buf_t *buf) mlen = scanned +sizeof (uint16_t ) +1 ;// ensure we don't read past buffer if (plen < mlen || plen != mlen + *(uint8_t *)(pdata+sizeof (uint16_t ))) { - status =SDP_INVALID_SYNTAX ; + status =SDP_INVALID_PDU_SIZE ; goto done; }
I'm not sure exactly what test system you tested this with, but it breaks TP/SERVER/SS/BI-02-C with the BITE tester with test vector 1.0.40.0. Also, this code path doesn't seem to be traversed at all for TP/SERVER/SS/BI-01-C which the patch claims to fix. In order to get a clean test report again from the BITE I went ahead and reverted[1] this patch. Now both SS/BI-01-C and SS/BI-02-C are passing with the BITE. Your other SDP patches don't seem to have any issues.
Johan
[1] http://git.kernel.org/?p=bluetooth/bluez.git;a=commitdiff;h=24dbc52388f1ef2e759d24d74cd32f93531c8857
PATCH v2 2/4 Bluetooth: Send an Invalid PDU Size Error Response for Service Attr Req
In reply to Angela BartholomausSend error code 0x04 per CoreSpecv2.1, sec 4.4 for TP/SERVER/SA/BI-03-C
--- src/sdpd-request.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
src/sdpd-request.c +1 -1
@@ -667,7 +667,7 @@ static int service_attr_req(sdp_req_t *req, sdp_buf_t *buf) mlen = scanned +sizeof (uint32_t ) +sizeof (uint16_t ) +1 ;// ensure we don't read past buffer if (plen < mlen || plen != mlen + *(uint8_t *)pdata) { - status =SDP_INVALID_SYNTAX ; + status =SDP_INVALID_PDU_SIZE ; goto done; }
Signature · 5 lines
1.7.2.2 -- Angela Bartholomaus Sent by an employee of the Qualcomm Innovation Center, Inc. The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum.
PATCH v2 3/4 Bluetooth: Send an Invalid PDU Size Error Resp for Service Attr Search Req
In reply to Angela BartholomausSend error code 0x04 per CoreSpecv2.1, sec 4.4 for TP/SERVER/SSA/BI-02-C
--- src/sdpd-request.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
src/sdpd-request.c +1 -1
@@ -818,7 +818,7 @@ static int service_search_attr_req(sdp_req_t *req, sdp_buf_t *buf) plen =ntohs (((sdp_pdu_hdr_t *)(req->buf))->plen);if (plen < totscanned || plen != totscanned + *(uint8_t *)pdata) { - status =SDP_INVALID_SYNTAX ; + status =SDP_INVALID_PDU_SIZE ; goto done; }
Signature · 5 lines
1.7.2.2 -- Angela Bartholomaus Sent by an employee of the Qualcomm Innovation Center, Inc. The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum.
PATCH v2 4/4 Bluetooth: Send Invalid Syntax Error if Resp Size Less Than 0x07
In reply to Angela BartholomausByte cnt range min 0x07 per Core v2.1, sec 4.61 for TP/SERVER/SA/BI-02-C
--- src/sdpd-request.c | 9 +++++++++ 1 files changed, 9 insertions(+), 0 deletions(-)
src/sdpd-request.c +9 -0
@@ -684,6 +684,15 @@ static int service_attr_req(sdp_req_t *req, sdp_buf_t *buf)SDPDBG ("max_rsp_size : %d" , max_rsp_size);/* +* Check that max_rsp_size is within valid range +* a minimum size of 0x0007 has to be used for data field +*/ +if (max_rsp_size <0x0007 ) { + status =SDP_INVALID_SYNTAX ; + goto done; + } + +/* * Calculate Attribute size acording to MTU * We can send only (MTU - sizeof(sdp_pdu_hdr_t) - sizeof(sdp_cont_state_t)) */
Signature · 5 lines
1.7.2.2 -- Angela Bartholomaus Sent by an employee of the Qualcomm Innovation Center, Inc. The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum.
Hi Angela,
Quoted 3 lines · Angela Bartholomaus
Fixed the following issues revealed while performing bluez qualification:
- Incorrect error code was being reported for requests with invalid PDU size;
- No error was being reported if a request less than0x07was received.
Thanks. All four patches have been pushed upstream.
Johan