CVE-2026-58835 AI-generated analysis

platform/packages/modules/Bluetooth, system/btif (btif_storage, bt_config property read-back)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (3 corrections). Verify against the commit before relying on it.

In system/btif/src/btif_storage.cc cfg2prop(), the BT_PROPERTY_UUIDS / BT_PROPERTY_UUIDS_LE path now limits btif_split_uuids_string() to the caller-supplied buffer capacity (prop->len / sizeof(Uuid)) instead of the hardcoded BT_MAX_NUM_UUIDS.

Root cause

cfg2prop() in system/btif/src/btif_storage.cc reads the stored remote service UUID string (BTIF_STORAGE_KEY_REMOTE_SERVICE or BTIF_STORAGE_KEY_REMOTE_SERVICE_LE) into a 1280-byte local buffer. It then parses that string with btif_split_uuids_string(value, p_uuid, BT_MAX_NUM_UUIDS), where p_uuid is prop->val. BT_MAX_NUM_UUIDS is a constant and ignores prop->len, the real capacity of the caller's bt_property_t value buffer. Sibling cases in the same switch (e.g. BT_PROPERTY_CLASS_OF_DEVICE, BT_PROPERTY_REMOTE_VERSION_INFO) check prop->len against the type size before writing. This case had no link between the write limit and the buffer size, so a stored string with more UUIDs than fit in prop->val could be written past the end of the caller's buffer. The commit message also calls this a companion to ag/40421805, whose content is not in the material.

How the fix works

• system/btif/src/btif_storage.cc:cfg2prop() (cases BT_PROPERTY_UUIDS / BT_PROPERTY_UUIDS_LE): the third argument to btif_split_uuids_string() changes from BT_MAX_NUM_UUIDS to prop->len / sizeof(Uuid). The parser now writes at most as many Uuid entries as fit in the caller-provided prop->val buffer. prop->len is then set to num_uuids * sizeof(Uuid), as before.
• system/btif/test/btif_storage_test.cc: adds TEST(BtifStorageTest, test_uuid_split_zero_limit). It calls btif_split_uuids_string() with a limit of 0 on a two-UUID string and asserts that it returns 0 and leaves the destination array untouched. This tests btif_split_uuids_string() itself, which this commit does not modify (that behavior may come from the companion change ag/40421805, which is not shown).

Completeness

• Covers both BT_PROPERTY_UUIDS and BT_PROPERTY_UUIDS_LE, since they share one code block in cfg2prop().
• The fix depends on btif_split_uuids_string() honoring the max count, including a limit of 0. The new test asserts this, but btif_split_uuids_string() is not changed in this commit, so correctness may depend on the companion change ag/40421805 (contents unknown).
• prop->len is compared as an int in sibling cases. The new expression prop->len / sizeof(Uuid) converts it to size_t. This case adds no explicit check that prop->len is non-negative, unlike the explicit prop->len >= sizeof(...) checks in sibling cases. The material does not show whether a negative prop->len can reach this point.
• The commit only addresses the read-back path (cfg2prop). Other callers of btif_split_uuids_string() are not shown in the material and are not touched by this diff.

Behavior changes

• When the stored UUID string holds more UUIDs than fit in the caller's buffer, the result is now silently truncated to prop->len / sizeof(Uuid) entries (prop->len reports the truncated size) instead of overflowing.
• If the caller passes a prop->len smaller than sizeof(Uuid), zero UUIDs are returned and prop->len becomes 0, while ret is still true.
• No new error codes or logging in the diff.

Per major

• Android 14: Not listed by the bulletin (not affected per the bulletin). At android-security-14.0.0_r30, 4/6 lines of the patched region are present. The material does not show which lines are missing or whether the hardcoded-limit call exists on this branch.
• Android 15: Not listed by the bulletin (not affected per the bulletin). At android-security-15.0.0_r18, 4/6 lines of the patched region are present. Which lines are missing is not shown.
• Android 16: Same fix: commit 91bef351ef64 in android-security-16.0.0_r8 (cherry-pick of 95ecd904327158fc73ed6b156502f209fc3f8f6f, Change-Id Ib6041c55f705afd9e9a8b980d7af9ba23aae2f02). Patched code confirmed at android-security-16.0.0_r9 (btif_storage.cc lines 318-319).
• Android 17: Same fix: commit 5f719e21eef1 in android-security-17.0.0_r1. The btif_storage.cc change is identical apart from the hunk offset and the enclosing function's parameter name (addr instead of remote_bd_addr). The test addition is the same apart from a trailing blank line. Present at android-security-17.0.0_r2.

Unknowns

• Content of the companion change ag/40421805, and whether it modifies btif_split_uuids_string() (the new test suggests limit-0 handling depends on it).
• Which callers of cfg2prop() (via btif_storage) pass a prop->val buffer smaller than BT_MAX_NUM_UUIDS * sizeof(Uuid), and how the stored UUID string reaches bt_config.
• Whether the vulnerable call exists on the Android 14/15 branches even though the bulletin does not list them (the per-major facts only show partial region presence).
• Whether prop->len can be negative at this call site.

Back to October 2026 · Findings