[Bluetooth] Enforce that PSMs must be odd.

chrome/browser/extensions/api/bluetooth_socket/bluetooth_socket_api.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/api/bluetooth_socket/bluetooth_socket_api.h"
 
+#include <stdint.h>
+
 #include "chrome/browser/extensions/api/bluetooth_socket/bluetooth_api_socket.h"
 #include "chrome/browser/extensions/api/bluetooth_socket/bluetooth_socket_event_dispatcher.h"
 #include "chrome/common/extensions/api/bluetooth/bluetooth_manifest_data.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_thread.h"
 #include "device/bluetooth/bluetooth_adapter.h"
 #include "device/bluetooth/bluetooth_adapter_factory.h"
 #include "device/bluetooth/bluetooth_device.h"
 #include "device/bluetooth/bluetooth_socket.h"
 #include "extensions/common/permissions/permissions_data.h"
 #include "net/base/io_buffer.h"
 
 using content::BrowserThread;
 using extensions::BluetoothApiSocket;
 using extensions::api::bluetooth_socket::ListenOptions;
 using extensions::api::bluetooth_socket::SocketInfo;
 using extensions::api::bluetooth_socket::SocketProperties;
 
 namespace {
 
 const char kDeviceNotFoundError[] = "Device not found";
+const char kInvalidPsmError[] = "Invalid PSM";
 const char kInvalidUuidError[] = "Invalid UUID";
 const char kPermissionDeniedError[] = "Permission denied";
 const char kSocketNotFoundError[] = "Socket not found";
 
 linked_ptr<SocketInfo> CreateSocketInfo(int socket_id,
                                         BluetoothApiSocket* socket) {
   DCHECK(BrowserThread::CurrentlyOn(BluetoothApiSocket::kThreadId));
   linked_ptr<SocketInfo> socket_info(new SocketInfo());
   // This represents what we know about the socket, and does not call through
   // to the system.
@@ skipping 35 matching lines @@
   extensions::api::BluetoothSocketEventDispatcher* socket_event_dispatcher =
       extensions::api::BluetoothSocketEventDispatcher::Get(browser_context);
   DCHECK(socket_event_dispatcher)
       << "There is no socket event dispatcher. "
          "If this assertion is failing during a test, then it is likely that "
          "TestExtensionSystem is failing to provide an instance of "
          "BluetoothSocketEventDispatcher.";
   return socket_event_dispatcher;
 }
 
+// Returns |true| if |psm| is a valid PSM.
+// Per the Bluetooth specification, the PSM field must be at least two octets in
+// length, with least significant bit of the least significant octet equal to
+// '1' and the least significant bit of the most significant octet equal to '0'.
+bool IsValidPsm(int psm) {
+  if (psm <= 0)
+    return false;
+
+  std::vector<int16_t> octets;
+  while (psm > 0) {
+     octets.push_back(psm & 0xFF);
+     psm = psm >> 8;
+  }
+
+  if (octets.size() < 2U)
+    return false;
+
+  // The least significant bit of the least significant octet must be '1'.
+  if ((octets.front() & 0x01) != 1)
+    return false;
+
+  // The least significant bit of the most significant octet must be '0'.
+  if ((octets.back() & 0x01) != 0)
+    return false;
+
+  return true;
+}
+
 }  // namespace
 
 namespace extensions {
 namespace api {
 
 BluetoothSocketAsyncApiFunction::BluetoothSocketAsyncApiFunction() {}
 
 BluetoothSocketAsyncApiFunction::~BluetoothSocketAsyncApiFunction() {}
 
 bool BluetoothSocketAsyncApiFunction::RunAsync() {
@@ skipping 287 matching lines @@
     const device::BluetoothUUID& uuid,
     scoped_ptr<std::string> name,
     const device::BluetoothAdapter::CreateServiceCallback& callback,
     const device::BluetoothAdapter::CreateServiceErrorCallback&
         error_callback) {
   device::BluetoothAdapter::ServiceOptions service_options;
   service_options.name = name.Pass();
 
   ListenOptions* options = params_->options.get();
   if (options) {
-    if (options->psm.get())
-      service_options.psm.reset(new int(*(options->psm)));
+    if (options->psm) {
+      int psm = *options->psm;
+      if (!IsValidPsm(psm)) {
+        error_callback.Run(kInvalidPsmError);
+        return;
+      }
+
+      service_options.psm.reset(new int(psm));
+    }
   }
 
   adapter->CreateL2capService(uuid, service_options, callback, error_callback);
 }
 
 void BluetoothSocketListenUsingL2capFunction::CreateResults() {
   results_ = bluetooth_socket::ListenUsingL2cap::Results::Create();
 }
 
 BluetoothSocketConnectFunction::BluetoothSocketConnectFunction() {}
@@ skipping 217 matching lines @@
       if (socket) {
         socket_infos.push_back(CreateSocketInfo(socket_id, socket));
       }
     }
   }
   results_ = bluetooth_socket::GetSockets::Results::Create(socket_infos);
 }
 
 }  // namespace api
 }  // namespace extensions