Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0070ecd6 authored by Ted Wang's avatar Ted Wang Committed by Automerger Merge Worker
Browse files

Merge "Add length check when copy AVDTP packet" into tm-dev am: 851a2d15 

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/19500904



Change-Id: I8ec3f0dc09900578f8b2f7ff8e4c1c9764f0da47
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents b9fab331 851a2d15

system/stack/avdt/avdt_msg.cc

+4 −0
Original line number Diff line number Diff line
@@ -1252,6 +1252,10 @@ BT_HDR* avdt_msg_asmbl(AvdtpCcb* p_ccb, BT_HDR* p_buf) { 
     * would have allocated smaller buffer.

     */

    p_ccb->p_rx_msg = (BT_HDR*)osi_malloc(BT_DEFAULT_BUFFER_SIZE);

    if (sizeof(BT_HDR) + p_buf->offset + p_buf->len > BT_DEFAULT_BUFFER_SIZE) {

      android_errorWriteLog(0x534e4554, "232023771");

      return NULL;

    }

    memcpy(p_ccb->p_rx_msg, p_buf, sizeof(BT_HDR) + p_buf->offset + p_buf->len);



    /* Free original buffer */