安全整改：问题单3 缓冲区与内存安全 5 项 + 问题单6 确认真实缺陷 6 条（SM/DTAP/DIS/RSS）-communication_nearlink

Mservices/common/src/nearlink_freeze_utils.cpp+6-3

	@@ -164,9 +164,12 @@ void NearlinkFreezeUtil::ReportNlConnectStateToRss(
164	needDisConnect = (value == 0);	164	needDisConnect = (value == 0);
165	};	165	};
166	if (!ssapConnectState_.GetValueAndOpt(tempAppInfo, func)) {	166	if (!ssapConnectState_.GetValueAndOpt(tempAppInfo, func)) {
167	- ssapConnectState_.Insert(tempAppInfo, 1);	167	+ if (action == "CONNECT") {
168	- }	168	+ ssapConnectState_.Insert(tempAppInfo, 1);
169	- if(!needDisConnect){	169	+ return;
		170	+ }
		171	+ /* 非连接首见：无计数基准，放行上报 */
		172	+ } else if (!needDisConnect) {
170	return;	173	return;
171	}	174	}
172	}	175	}

Mservices/device_manager/src/nearlink_device_manager.cpp+1-1

	@@ -47,7 +47,7 @@ RawAddress GenerateRandomMacAddress()
47	int ret = 0;	47	int ret = 0;
48	std::string randomMac = "";	48	std::string randomMac = "";
49	char strMacTmp[ARRAY_SIZE] = {0};	49	char strMacTmp[ARRAY_SIZE] = {0};
50	- std::mt19937_64 gen(std::chrono::high_resolution_clock::now().time_since_epoch().count());	50	+ std::mt19937_64 gen(std::random_device{}());
51	for (int i = 0; i < MAC_BIT_SIZE; i++) {	51	for (int i = 0; i < MAC_BIT_SIZE; i++) {
52	if (i != FIRST_BIT) {	52	if (i != FIRST_BIT) {
53	std::uniform_int_distribution<> distribution(0, HEX_BASE - 1);	53	std::uniform_int_distribution<> distribution(0, HEX_BASE - 1);

Mservices/service/src/ssap/ssap_client_service.cpp+1-1

	@@ -94,7 +94,7 @@ void SsapClientService::impl::AdapterCallback::OnConnectionStateChanged(int appI
94	#ifdef RES_SCHED_SUPPORT	94	#ifdef RES_SCHED_SUPPORT
95	std::string action;	95	std::string action;
96	if (state == static_cast<uint8_t>(SleConnectState::CONNECTED)) {	96	if (state == static_cast<uint8_t>(SleConnectState::CONNECTED)) {
97	- action = "Connect";	97	+ action = "CONNECT";
98	} else if (state == static_cast<uint8_t>(SleConnectState::DISCONNECTED)) {	98	} else if (state == static_cast<uint8_t>(SleConnectState::DISCONNECTED)) {
99	action = "ACTIVE_DISCONNECT";	99	action = "ACTIVE_DISCONNECT";
100	}	100	}

Mservices/service/src/tws/TwsSharedLibApi.cpp+3-0

	@@ -14,6 +14,7 @@
14	*/	14	*/
15	#include <map>	15	#include <map>
16	#include <dlfcn.h>	16	#include <dlfcn.h>
		17	+#include <cstdint>
17		18
18	#include "TwsDefines.h"	19	#include "TwsDefines.h"
19	#include "TwsMessage.h"	20	#include "TwsMessage.h"
	@@ -239,6 +240,8 @@ bool TwsSharedLibApi::EncodeMessage(const TwsMessage event)
239	}	240	}
240		241
241	/* 按编解码库消息头拼接数据 */	242	/* 按编解码库消息头拼接数据 */
		243	+ NL_CHECK_RETURN_RET(event.serviceDataLen_ <= UINT16_MAX - sizeof(TwsEncodeMsg), false,
		244	+ "[Tws LibApi]:encode message failed,service data len over max!");
242	uint16_t encodeLen = sizeof(TwsEncodeMsg) + event.serviceDataLen_;	245	uint16_t encodeLen = sizeof(TwsEncodeMsg) + event.serviceDataLen_;
243	TwsEncodeMsg encodeSrc = reinterpret_cast<TwsEncodeMsg >(new(std::nothrow)uint8_t[encodeLen]);	246	TwsEncodeMsg encodeSrc = reinterpret_cast<TwsEncodeMsg >(new(std::nothrow)uint8_t[encodeLen]);
244	NL_CHECK_RETURN_RET(encodeSrc, false, "[Tws LibApi]:encode request/response message fail,alloc new mem fail!");	247	NL_CHECK_RETURN_RET(encodeSrc, false, "[Tws LibApi]:encode request/response message fail,alloc new mem fail!");

Mservices/stack/src/cp/bal/profile/dis/src/dis_server.c+13-6

	@@ -98,18 +98,25 @@ uint32_t DisAddServiceProperty(NLSTK_ServiceParam_S *service, NLSTK_DeviceInfo_S
98	size_t index = 0;	98	size_t index = 0;
99	uint32_t ret = DisAddPropertyInfo(&service->property[index++], &basicInfo->manufacturerInfo, DIS_MANUFACTURER_UUID,	99	uint32_t ret = DisAddPropertyInfo(&service->property[index++], &basicInfo->manufacturerInfo, DIS_MANUFACTURER_UUID,
100	basicInfo->propertyRights[DIS_MANUFACTURER_INFO]);	100	basicInfo->propertyRights[DIS_MANUFACTURER_INFO]);
101	- ret += DisAddPropertyInfo(&service->property[index++], &basicInfo->deviceModel, DIS_MODEL_UUID,	101	+ NLSTK_CHECK_RETURN(ret == NLSTK_ERRCODE_SUCCESS, ret, "[DIS] add property fail");
		102	+ ret = DisAddPropertyInfo(&service->property[index++], &basicInfo->deviceModel, DIS_MODEL_UUID,
102	basicInfo->propertyRights[DIS_MODEL_INFO]);	103	basicInfo->propertyRights[DIS_MODEL_INFO]);
103	- ret += DisAddPropertyInfo(&service->property[index++], &basicInfo->deviceSerialNumber, DIS_SERIAL_NUMBER_UUID,	104	+ NLSTK_CHECK_RETURN(ret == NLSTK_ERRCODE_SUCCESS, ret, "[DIS] add property fail");
		105	+ ret = DisAddPropertyInfo(&service->property[index++], &basicInfo->deviceSerialNumber, DIS_SERIAL_NUMBER_UUID,
104	basicInfo->propertyRights[DIS_SERIAL_INFO]);	106	basicInfo->propertyRights[DIS_SERIAL_INFO]);
105	- ret += DisAddPropertyInfo(&service->property[index++], &basicInfo->hardwareVersion, DIS_HARDWARE_VERSION_UUID,	107	+ NLSTK_CHECK_RETURN(ret == NLSTK_ERRCODE_SUCCESS, ret, "[DIS] add property fail");
		108	+ ret = DisAddPropertyInfo(&service->property[index++], &basicInfo->hardwareVersion, DIS_HARDWARE_VERSION_UUID,
106	basicInfo->propertyRights[DIS_HARDWARE_VERSION_INFO]);	109	basicInfo->propertyRights[DIS_HARDWARE_VERSION_INFO]);
107	- ret += DisAddPropertyInfo(&service->property[index++], &basicInfo->firmwareVersion, DIS_FIRMWARE_VERSION_UUID,	110	+ NLSTK_CHECK_RETURN(ret == NLSTK_ERRCODE_SUCCESS, ret, "[DIS] add property fail");
		111	+ ret = DisAddPropertyInfo(&service->property[index++], &basicInfo->firmwareVersion, DIS_FIRMWARE_VERSION_UUID,
108	basicInfo->propertyRights[DIS_FIRMWARE_VERSION_INFO]);	112	basicInfo->propertyRights[DIS_FIRMWARE_VERSION_INFO]);
109	- ret += DisAddPropertyInfo(&service->property[index++], &basicInfo->softwareVersion, DIS_SOFTWARE_VERSION_UUID,	113	+ NLSTK_CHECK_RETURN(ret == NLSTK_ERRCODE_SUCCESS, ret, "[DIS] add property fail");
		114	+ ret = DisAddPropertyInfo(&service->property[index++], &basicInfo->softwareVersion, DIS_SOFTWARE_VERSION_UUID,
110	basicInfo->propertyRights[DIS_SOFTWARE_VERSION_INFO]);	115	basicInfo->propertyRights[DIS_SOFTWARE_VERSION_INFO]);
111	- ret += DisAddPropertyInfo(&service->property[index++], &basicInfo->deviceLocalAlias, DIS_LOCAL_ALIAS_UUID,	116	+ NLSTK_CHECK_RETURN(ret == NLSTK_ERRCODE_SUCCESS, ret, "[DIS] add property fail");
		117	+ ret = DisAddPropertyInfo(&service->property[index++], &basicInfo->deviceLocalAlias, DIS_LOCAL_ALIAS_UUID,
112	basicInfo->propertyRights[DIS_LOCAL_ALIAS_INFO]);	118	basicInfo->propertyRights[DIS_LOCAL_ALIAS_INFO]);
		119	+ NLSTK_CHECK_RETURN(ret == NLSTK_ERRCODE_SUCCESS, ret, "[DIS] add property fail");
113	ret = DisAddDeviceAppearance(&service->property[index++], basicInfo);	120	ret = DisAddDeviceAppearance(&service->property[index++], basicInfo);
114	NLSTK_CHECK_RETURN(ret == NLSTK_ERRCODE_SUCCESS, ret, "[DIS] add device appearance fail");	121	NLSTK_CHECK_RETURN(ret == NLSTK_ERRCODE_SUCCESS, ret, "[DIS] add device appearance fail");
115	return NLSTK_ERRCODE_SUCCESS; // 所有属性添加成功	122	return NLSTK_ERRCODE_SUCCESS; // 所有属性添加成功

Mservices/stack/src/cp/bsl/sle/devd/src/devd_scan_manager.c+5-1

	@@ -565,7 +565,11 @@ static void ReportCbk(NLSTK_DevdAdvReportInfo_S *report)
565	if (result == NULL) {	565	if (result == NULL) {
566	return;	566	return;
567	}	567	}
568	- NLSTK_CHECK_RETURN_VOID(g_scanStm != NULL, "[DEVDS] g_scanStm is null");	568	+ if (g_scanStm == NULL) {
		569	+ NLSTK_LOG_ERROR("[DEVDS] g_scanStm is null");
		570	+ FreeAdvResult(result);
		571	+ return;
		572	+ }
569		573
570	NLSTK_DevdScanManager_S *manager = DEVD_STM_M(g_scanStm, scanManager);	574	NLSTK_DevdScanManager_S *manager = DEVD_STM_M(g_scanStm, scanManager);
571	SDF_Vector_S *scanners[DEVD_MAX_MODULE_ID] = {0};	575	SDF_Vector_S *scanners[DEVD_MAX_MODULE_ID] = {0};

Mservices/stack/src/cp/bsl/sle/devd/src/nlstk_devd_api.c+2-0

	@@ -379,6 +379,8 @@ static NLSTK_Errcode_E DevdCopyAdvData(NLSTK_DevdAdvData_S *advData, NLSTK_DevdA
379	advData->advDataLen = setData->advDataLen;	379	advData->advDataLen = setData->advDataLen;
380	NLSTK_CHECK_RETURN(advData->advDataLen > 0 && advData->advDataLen <= DEFAULT_MAX_ADV_DATA_LEN,	380	NLSTK_CHECK_RETURN(advData->advDataLen > 0 && advData->advDataLen <= DEFAULT_MAX_ADV_DATA_LEN,
381	NLSTK_ERRCODE_PARAM_ERR, "[DEVD]memory len error");	381	NLSTK_ERRCODE_PARAM_ERR, "[DEVD]memory len error");
		382	+ NLSTK_CHECK_RETURN(setData->scanRspDataLen <= DEFAULT_MAX_ADV_DATA_LEN,
		383	+ NLSTK_ERRCODE_PARAM_ERR, "[DEVD]scan rsp data len error");
382	advData->advData = (uint8_t *)SDF_MemZalloc(advData->advDataLen);	384	advData->advData = (uint8_t *)SDF_MemZalloc(advData->advDataLen);
383	NLSTK_CHECK_RETURN(advData->advData != NULL, NLSTK_ERRCODE_MALLOC_FAIL, "[DEVD]memory alloc error");	385	NLSTK_CHECK_RETURN(advData->advData != NULL, NLSTK_ERRCODE_MALLOC_FAIL, "[DEVD]memory alloc error");
384	(void)memcpy_s(advData->advData, advData->advDataLen, setData->advData, setData->advDataLen);	386	(void)memcpy_s(advData->advData, advData->advDataLen, setData->advData, setData->advDataLen);

Mservices/stack/src/cp/bsl/sle/sm/src/sm_nego.c+6-0

	@@ -249,6 +249,12 @@ static void RecvPairingCfm(SmSLink_S slink, const uint8_t pkg, size_t size)
249	.what = SM_INTERNAL_ERROR, .extData = (void *)(uintptr_t)SM_ERR_AUTHENTICATION_REQUIREMENTS });	249	.what = SM_INTERNAL_ERROR, .extData = (void *)(uintptr_t)SM_ERR_AUTHENTICATION_REQUIREMENTS });
250	return;	250	return;
251	}	251	}
		252	+ if (memcmp(slink->negoParams.codeAlgoCap, msg->codeAlgoCap, SM_OCTETS_4) != 0) {
		253	+ NLSTK_LOG_ERROR("[SM] Code algo capability mismatch.");
		254	+ STM_MFUNC(slink->stm, ProcessMessage, (Message) {
		255	+ .what = SM_INTERNAL_ERROR, .extData = (void *)(uintptr_t)SM_ERR_UNSPECIFIED_REASON });
		256	+ return;
		257	+ }
252	for (int i = 0; i < SM_OCTETS_4; i++) {	258	for (int i = 0; i < SM_OCTETS_4; i++) {
253	slink->negoParams.codeAlgoCap[i] = msg->codeAlgoCap[i];	259	slink->negoParams.codeAlgoCap[i] = msg->codeAlgoCap[i];
254	}	260	}

Mservices/stack/src/dli/layer/src/dli_layer.c+2-0

	@@ -150,6 +150,8 @@ static void DLI_CmdTimerCallback(void *arg)
150	if (DLI_PostOtherThread(cmdNode->info->timeoutCallback, (void *)cmdNode, DLI_CmdNodeDestroy) != 0) {	150	if (DLI_PostOtherThread(cmdNode->info->timeoutCallback, (void *)cmdNode, DLI_CmdNodeDestroy) != 0) {
151	DLI_LOGE("post timeout evt failed.");	151	DLI_LOGE("post timeout evt failed.");
152	}	152	}
		153	+ } else {
		154	+ DLI_CmdNodeDestroy((void *)cmdNode);
153	}	155	}
154		156
155	DLI_PostNextTask(DLI_CMD_TASK);	157	DLI_PostNextTask(DLI_CMD_TASK);

Mservices/stack/src/dp/dtap/src/dtap_scheduler.c+18-2

	@@ -669,7 +669,12 @@ static bool DTAP_SendData(uint16_t lcid, SDF_Buff_S buff, DTAP_LcidBufferNode
669		669
670	static bool DTAP_SaveFragmentData(uint16_t lcid, SDF_Buff_S *buff[], uint32_t remainBuffCnt)	670	static bool DTAP_SaveFragmentData(uint16_t lcid, SDF_Buff_S *buff[], uint32_t remainBuffCnt)
671	{	671	{
672	- DTAP_PendingPacket *pendingPkt[remainBuffCnt];	672	+ DTAP_PendingPacket **pendingPkt =
		673	+ (DTAP_PendingPacket *)SDF_MemZalloc(remainBuffCnt sizeof(DTAP_PendingPacket *));
		674	+ if (pendingPkt == NULL) {
		675	+ DTAP_LOGE("malloc pending pkt array failed, remainBuffCnt %u", remainBuffCnt);
		676	+ return false;
		677	+ }
673	for (uint32_t i = 0; i < remainBuffCnt; i++) {	678	for (uint32_t i = 0; i < remainBuffCnt; i++) {
674	DTAP_PendingPacket *pkt = DTAP_CreatePacket(buff[i]);	679	DTAP_PendingPacket *pkt = DTAP_CreatePacket(buff[i]);
675	if (pkt == NULL) {	680	if (pkt == NULL) {
	@@ -677,6 +682,7 @@ static bool DTAP_SaveFragmentData(uint16_t lcid, SDF_Buff_S *buff[], uint32_t re
677	DTAP_DestroyPacket((SDF_DListEntry_S *)pendingPkt[j]);	682	DTAP_DestroyPacket((SDF_DListEntry_S *)pendingPkt[j]);
678	}	683	}
679	DTAP_LOGE("malloc pending packet failed, i %d, remainBuffCnt %d", i, remainBuffCnt);	684	DTAP_LOGE("malloc pending packet failed, i %d, remainBuffCnt %d", i, remainBuffCnt);
		685	+ SDF_MemFree(pendingPkt);
680	return false;	686	return false;
681	}	687	}
682	pkt->isSplited = true;	688	pkt->isSplited = true;
	@@ -704,11 +710,13 @@ static bool DTAP_SaveFragmentData(uint16_t lcid, SDF_Buff_S *buff[], uint32_t re
704	SDF_DListElmTailInsert(&fragmentChannel->pktList, pendingPkt[i], entry);	710	SDF_DListElmTailInsert(&fragmentChannel->pktList, pendingPkt[i], entry);
705	}	711	}
706	DTAP_LOGD("save fragment data success, lcid %d, remainBuffCnt %d", lcid, remainBuffCnt);	712	DTAP_LOGD("save fragment data success, lcid %d, remainBuffCnt %d", lcid, remainBuffCnt);
		713	+ SDF_MemFree(pendingPkt);
707	return true;	714	return true;
708	FAILED:	715	FAILED:
709	for (uint32_t i = 0; i < remainBuffCnt; i++) {	716	for (uint32_t i = 0; i < remainBuffCnt; i++) {
710	DTAP_DestroyPacket((SDF_DListEntry_S *)pendingPkt[i]);	717	DTAP_DestroyPacket((SDF_DListEntry_S *)pendingPkt[i]);
711	}	718	}
		719	+ SDF_MemFree(pendingPkt);
712	return false;	720	return false;
713	}	721	}
714		722
	@@ -740,8 +748,13 @@ static bool DTAP_ScheduleLcid(DTAP_PriorityQueue q, DTAP_LcidNode lcidNode, DT
740		748
741	uint32_t fragmentCnt = DLI_GetDataFragmentNums(pkt->buff);	749	uint32_t fragmentCnt = DLI_GetDataFragmentNums(pkt->buff);
742	CHECK_AND_RETURN_RET_LOG(DTAP_TAG, fragmentCnt != 0, false, "fragmentCnt is 0");	750	CHECK_AND_RETURN_RET_LOG(DTAP_TAG, fragmentCnt != 0, false, "fragmentCnt is 0");
743	- SDF_Buff_S *fragmentBuf[fragmentCnt];	751	+ SDF_Buff_S fragmentBuf = (SDF_Buff_S )SDF_MemZalloc(fragmentCnt * sizeof(SDF_Buff_S *));
		752	+ if (fragmentBuf == NULL) {
		753	+ DTAP_LOGE("malloc fragment buf array failed, fragmentCnt %u", fragmentCnt);
		754	+ return false;
		755	+ }
744	if (!DTAP_SplitData(channelNode->lcid, pkt->buff, fragmentBuf, fragmentCnt)) {	756	if (!DTAP_SplitData(channelNode->lcid, pkt->buff, fragmentBuf, fragmentCnt)) {
		757	+ SDF_MemFree(fragmentBuf);
745	return false;	758	return false;
746	}	759	}
747	SDF_BuffFree(pkt->buff);	760	SDF_BuffFree(pkt->buff);
	@@ -754,15 +767,18 @@ static bool DTAP_ScheduleLcid(DTAP_PriorityQueue q, DTAP_LcidNode lcidNode, DT
754		767
755	DTAP_PriorityQueuePop(q, lcidNode, channelNode, node, pkt);	768	DTAP_PriorityQueuePop(q, lcidNode, channelNode, node, pkt);
756	if (sendCnt >= fragmentCnt) {	769	if (sendCnt >= fragmentCnt) {
		770	+ SDF_MemFree(fragmentBuf);
757	continue;	771	continue;
758	}	772	}
759	if (!DTAP_SaveFragmentData(channelNode->lcid, &fragmentBuf[sendCnt], (fragmentCnt - sendCnt))) {	773	if (!DTAP_SaveFragmentData(channelNode->lcid, &fragmentBuf[sendCnt], (fragmentCnt - sendCnt))) {
760	for (uint32_t i = sendCnt; i < fragmentCnt; i++) {	774	for (uint32_t i = sendCnt; i < fragmentCnt; i++) {
761	SDF_BuffFree(fragmentBuf[i]);	775	SDF_BuffFree(fragmentBuf[i]);
762	}	776	}
		777	+ SDF_MemFree(fragmentBuf);
763	DTAP_LOGE("save fragment channel failed, lcid %d", channelNode->lcid);	778	DTAP_LOGE("save fragment channel failed, lcid %d", channelNode->lcid);
764	return false;	779	return false;
765	}	780	}
		781	+ SDF_MemFree(fragmentBuf);
766	break;	782	break;
767	}	783	}
768	return true;	784	return true;

Mservices/stack/src/dp/dtap/src/dtap_trans_stream.c+2-2

	@@ -210,9 +210,9 @@ static void DTAP_ReorderStreamFrameTask(void *args)
210	FreeStreamRxNode(node);	210	FreeStreamRxNode(node);
211	}	211	}
212		212
213	- if (node != NULL) {	213	+ if (!SDF_DListIsEmpty(&stream->rxList)) {
214	ReportExpectedStreamFrame(transChan);	214	ReportExpectedStreamFrame(transChan);
215	- stream->maxExpectedSeq = ((StreamRxNode *)SDF_DListLast(&stream->rxList))->txSeq + 1;	215	+ stream->maxExpectedSeq = DTAP_GetNextFrameSeq(((StreamRxNode *)SDF_DListLast(&stream->rxList))->txSeq);
216	StartReorderTimer(transChan);	216	StartReorderTimer(transChan);
217	}	217	}
218	}	218	}