Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a93bdd05 authored by Paul Colta's avatar Paul Colta Committed by Paul Colța
Browse files

HDMICEC: Out of Bounds Write in sendMessage in HdmiCec.cpp 

Bug: 278243594
Test: m && m android.hardware.tv.cec@1.0 && m android.hardware.tv.cec@1.0-service && atest VtsHalTvCecV1_0TargetTest
Change-Id: I2989f66f41172b345e3047218e138358c18b8644
(cherry picked from commit 2371bc81)
parent d6976527

tv/cec/1.0/default/HdmiCec.cpp

+3 −0
Original line number Original line Diff line number Diff line
@@ -307,6 +307,9 @@ Return<void> HdmiCec::getPhysicalAddress(getPhysicalAddress_cb _hidl_cb) { 
}

}





Return<SendMessageResult> HdmiCec::sendMessage(const CecMessage& message) {

Return<SendMessageResult> HdmiCec::sendMessage(const CecMessage& message) {

    if (message.body.size() > CEC_MESSAGE_BODY_MAX_LENGTH) {

        return SendMessageResult::FAIL;

    }

    cec_message_t legacyMessage {

    cec_message_t legacyMessage {

        .initiator = static_cast<cec_logical_address_t>(message.initiator),

        .initiator = static_cast<cec_logical_address_t>(message.initiator),

        .destination = static_cast<cec_logical_address_t>(message.destination),

        .destination = static_cast<cec_logical_address_t>(message.destination),