Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 15a996bd authored by Ted Wang's avatar Ted Wang Committed by Android (Google) Code Review
Browse files

Merge "Add length check when copy AVDTP packet" into tm-qpr-dev

parents 42e7b1d3 9f083ec9

system/stack/avdt/avdt_msg.cc

+4 −0
Original line number Diff line number Diff line
@@ -1252,6 +1252,10 @@ BT_HDR* avdt_msg_asmbl(AvdtpCcb* p_ccb, BT_HDR* p_buf) { 
     * would have allocated smaller buffer.

     */

    p_ccb->p_rx_msg = (BT_HDR*)osi_malloc(BT_DEFAULT_BUFFER_SIZE);

    if (sizeof(BT_HDR) + p_buf->offset + p_buf->len > BT_DEFAULT_BUFFER_SIZE) {

      android_errorWriteLog(0x534e4554, "232023771");

      return NULL;

    }

    memcpy(p_ccb->p_rx_msg, p_buf, sizeof(BT_HDR) + p_buf->offset + p_buf->len);



    /* Free original buffer */