[PATCH v2 0/4] Fix error reporting for SDP Requests

[PATCH v2 0/4] Fix error reporting for SDP Requests

[Angela Bartholomaus]

Fixed the following issues revealed while performing bluez qualification: 
- Incorrect error code was being reported for requests with invalid PDU size;
- No error was being reported if a request less than 0x07 was received.


--
Angela Bartholomaus
Sent by an employee of the Qualcomm Innovation Center, Inc.
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum.

[PATCH 1/4] Bluetooth: Send an Invalid PDU Size Error Response for Service Search Req

[Angela Bartholomaus]

Send error code 0x04 per CoreSpecv2.1, sec 4.4 for TP/SERVER/SS/BI-01-C
---
 src/sdpd-request.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/src/sdpd-request.c b/src/sdpd-request.c
index d56ffc2..cc9fe82 100644
--- a/src/sdpd-request.c
+++ b/src/sdpd-request.c
@@ -367,7 +367,7 @@ static int service_search_req(sdp_req_t *req, sdp_buf_t *buf)
 	mlen = scanned + sizeof(uint16_t) + 1;
 	// ensure we don't read past buffer
 	if (plen < mlen || plen != mlen + *(uint8_t *)(pdata+sizeof(uint16_t))) {
-		status = SDP_INVALID_SYNTAX;
+		status = SDP_INVALID_PDU_SIZE;
 		goto done;
 	}
 
-- 
1.7.2.2
--
Angela Bartholomaus
Sent by an employee of the Qualcomm Innovation Center, Inc.
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum.

[PATCH 2/4] Bluetooth: Send an Invalid PDU Size Error Response for Service Attr Req

[Angela Bartholomaus]

Send error code 0x04 per CoreSpecv2.1, sec 4.4 for TP/SERVER/SA/BI-03-C
---
 src/sdpd-request.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/src/sdpd-request.c b/src/sdpd-request.c
index cc9fe82..ccbd920 100644
--- a/src/sdpd-request.c
+++ b/src/sdpd-request.c
@@ -667,7 +667,7 @@ static int service_attr_req(sdp_req_t *req, sdp_buf_t *buf)
 	mlen = scanned + sizeof(uint32_t) + sizeof(uint16_t) + 1;
 	// ensure we don't read past buffer
 	if (plen < mlen || plen != mlen + *(uint8_t *)pdata) {
-		status = SDP_INVALID_SYNTAX;
+		status = SDP_INVALID_PDU_SIZE;
 		goto done;
 	}
 
-- 
1.7.2.2
--
Angela Bartholomaus
Sent by an employee of the Qualcomm Innovation Center, Inc.
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum.

[PATCH 3/4] Bluetooth: Send an Invalid PDU Size Error Resp for Service Attr Search Req

[Angela Bartholomaus]

Send error code 0x04 per CoreSpecv2.1, sec 4.4 for TP/SERVER/SSA/BI-02-C
---
 src/sdpd-request.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/src/sdpd-request.c b/src/sdpd-request.c
index ccbd920..8547939 100644
--- a/src/sdpd-request.c
+++ b/src/sdpd-request.c
@@ -818,7 +818,7 @@ static int service_search_attr_req(sdp_req_t *req, sdp_buf_t *buf)
 
 	plen = ntohs(((sdp_pdu_hdr_t *)(req->buf))->plen);
 	if (plen < totscanned || plen != totscanned + *(uint8_t *)pdata) {
-		status = SDP_INVALID_SYNTAX;
+		status = SDP_INVALID_PDU_SIZE;
 		goto done;
 	}
 
-- 
1.7.2.2
--
Angela Bartholomaus
Sent by an employee of the Qualcomm Innovation Center, Inc.
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum.

[PATCH 4/4] Bluetooth: Send Invalid Syntax Error if Resp Size Less Than 0x07

[Angela Bartholomaus]

Byte cnt range min 0x07 per Core v2.1, sec 4.61 for TP/SERVER/SA/BI-02-C
---
 src/sdpd-request.c |    9 +++++++++
 1 files changed, 9 insertions(+), 0 deletions(-)

diff --git a/src/sdpd-request.c b/src/sdpd-request.c
index 8547939..205b27b 100644
--- a/src/sdpd-request.c
+++ b/src/sdpd-request.c
@@ -684,6 +684,15 @@ static int service_attr_req(sdp_req_t *req, sdp_buf_t *buf)
 	SDPDBG("max_rsp_size : %d", max_rsp_size);
 
 	/*
+	 * Check that max_rsp_size is within valid range
+	 * a minimum size of 0x0007 has to be used for data field
+	 */
+	if (max_rsp_size < 0x0007) {
+		status = SDP_INVALID_SYNTAX;
+		goto done;
+	}
+
+	/*
 	 * Calculate Attribute size acording to MTU
 	 * We can send only (MTU - sizeof(sdp_pdu_hdr_t) - sizeof(sdp_cont_state_t))
 	 */
-- 
1.7.2.2
--
Angela Bartholomaus
Sent by an employee of the Qualcomm Innovation Center, Inc.
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum.

Re: [PATCH v2 0/4] Fix error reporting for SDP Requests

[Johan Hedberg]

Hi Angela,

On Wed, Aug 25, 2010, Angela Bartholomaus wrote:
> Fixed the following issues revealed while performing bluez qualification: 
> - Incorrect error code was being reported for requests with invalid PDU size;
> - No error was being reported if a request less than 0x07 was received.

Thanks. All four patches have been pushed upstream.

Johan

Re: [PATCH 1/4] Bluetooth: Send an Invalid PDU Size Error Response for Service Search Req

[Johan Hedberg]

Hi Angela,

On Wed, Aug 25, 2010, Angela Bartholomaus wrote:
> Send error code 0x04 per CoreSpecv2.1, sec 4.4 for TP/SERVER/SS/BI-01-C
> ---
>  src/sdpd-request.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
> 
> diff --git a/src/sdpd-request.c b/src/sdpd-request.c
> index d56ffc2..cc9fe82 100644
> --- a/src/sdpd-request.c
> +++ b/src/sdpd-request.c
> @@ -367,7 +367,7 @@ static int service_search_req(sdp_req_t *req, sdp_buf_t *buf)
>  	mlen = scanned + sizeof(uint16_t) + 1;
>  	// ensure we don't read past buffer
>  	if (plen < mlen || plen != mlen + *(uint8_t *)(pdata+sizeof(uint16_t))) {
> -		status = SDP_INVALID_SYNTAX;
> +		status = SDP_INVALID_PDU_SIZE;
>  		goto done;
>  	}

I'm not sure exactly what test system you tested this with, but it
breaks TP/SERVER/SS/BI-02-C with the BITE tester with test vector
1.0.40.0. Also, this code path doesn't seem to be traversed at all for
TP/SERVER/SS/BI-01-C which the patch claims to fix. In order to get a
clean test report again from the BITE I went ahead and reverted[1] this
patch. Now both SS/BI-01-C and SS/BI-02-C are passing with the BITE.
Your other SDP patches don't seem to have any issues.

Johan

[1] http://git.kernel.org/?p=bluetooth/bluez.git;a=commitdiff;h=24dbc52388f1ef2e759d24d74cd32f93531c8857