CVE-2026-28662 AI-generated analysis
platform/external/wpa_supplicant_8, P2P (Wi-Fi Direct) P2P2 provision discovery / pairing bootstrapping (src/p2p/p2p_pd.c)
Adds a bounds check in p2p_process_prov_disc_bootstrap_req (src/p2p/p2p_pd.c) that rejects a P2P2 PBMA comeback cookie longer than the fixed-size dev->bootstrap_params->cookie buffer, and enables the UBSan "bounds" sanitizer on a wpa_supplicant cc_library in wpa_supplicant/Android.bp.
Root cause
In p2p_process_prov_disc_bootstrap_req, when a Provision Discovery Request carries a PBMA attribute and status P2P_SC_COMEBACK, the code reads a one-byte cookie_len from the frame. It only checked that the attribute was long enough (msg->pbma_info_len < 1 + cookie_len) and never compared cookie_len with the size of the fixed-size cookie array in dev->bootstrap_params. The commit message describes the result as a heap overflow triggered by a malicious Wi-Fi Direct peer sending an oversized PBMA cookie length. In the shown code, cookie_len is next used in the comparison with dev->bootstrap_params->cookie_len and in os_memcmp. The material does not show which access actually overflows.
How the fix works
- src/p2p/p2p_pd.c:p2p_process_prov_disc_bootstrap_req: right after the existing 'Truncated PBMA' check, adds `if (cookie_len > sizeof(dev->bootstrap_params->cookie)) { p2p_dbg(p2p, "Too long PBMA cookie"); return; }`. The frame-supplied cookie_len is now limited to the capacity of the stored cookie buffer before `cookie = pos` and before the os_memcmp against dev->bootstrap_params->cookie. sizeof does not dereference dev->bootstrap_params, so the check is safe even when bootstrap_params is NULL. The later `!dev->bootstrap_params` check still handles that case.
- wpa_supplicant/Android.bp: adds "bounds" to sanitize.misc_undefined of the cc_library that compiles src/pasn/pasn_initiator.c, pasn_responder.c and pasn_common.c. The commit message calls this the libpasn target, and it sits in the cuttlefish section of the file. The entry joins the existing unsigned-integer-overflow, signed-integer-overflow and cfi settings. This is defense in depth and does not by itself fix the P2P bug.
Completeness
- The length check covers the PBMA comeback branch (status == P2P_SC_COMEBACK) of p2p_process_prov_disc_bootstrap_req, which is the only use of cookie_len shown in the material.
- The os_memcmp is also guarded by `dev->bootstrap_params->cookie_len != cookie_len`. The material does not show where bootstrap_params->cookie_len is set or whether that code limits it, so it cannot be judged whether the new check is the only guard or a redundant one.
- The non-comeback 'PBMA request' branch (WPA_GET_LE16(pos)) is not changed. The shown context does not indicate a length problem there.
- The sanitizer change touches only one cc_library in the cuttlefish section of wpa_supplicant/Android.bp. The non-cuttlefish build section and hostapd are not modified in this diff, even though the title mentions hardening hostapd.
- No fix is shown for any counterpart in response processing. The material does not include such code, so nothing can be concluded about it.
Behavior changes
- A PBMA comeback Provision Discovery Request whose cookie length exceeds sizeof(dev->bootstrap_params->cookie) is now dropped with the debug log 'Too long PBMA cookie' instead of being processed. The function returns without sending a response, the same way the existing 'Truncated PBMA' case does.
- The library built from the modified cc_library in wpa_supplicant/Android.bp now has UBSan bounds checking enabled. This turns detected out-of-bounds array accesses into aborts (general platform knowledge).
Per major
- Android 14: not affected: not listed by the bulletin. android-security-14.0.0_r29 has 0/5 lines of the patched region.
- Android 15: not affected: not listed by the bulletin. android-security-15.0.0_r17 has 0/5 lines of the patched region.
- Android 16: same fix: commit 3f792f7b7afa in android-security-16.0.0_r8 (matched by Change-Id Ic3c75644dbb7b3ea278335e977ad428ae14d9709), with the same p2p_pd.c and Android.bp hunks. 5/5 patched lines present.
- Android 17: same fix: commit b8d36c897dde in android-security-17.0.0_r1, with identical hunks (the Android.bp hunk starts at line 696 instead of 683). 5/5 patched lines present.
Unknowns
- Where dev->bootstrap_params->cookie_len and cookie are set, and whether that code limits the length. The material does not show the struct definition or that code.
- The exact size of the cookie array in bootstrap_params.
- Which access actually overflows (the os_memcmp read or something else). The shown code only exposes the os_memcmp use of cookie_len.
- Whether P2P2 is enabled in all Android 16 device builds (the bulletin lists 16, 16-qpr2, 17 and 17-next as affected).
- Whether the P2P2 code is entirely absent from Android 14/15 trees, beyond the patched region not being present.
- Which hostapd changes, if any, the title refers to. The diff touches only wpa_supplicant/Android.bp and src/p2p/p2p_pd.c.