Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 206bc33c authored by Pavlin Radoslavov's avatar Pavlin Radoslavov Committed by android-build-merger
Browse files

Merge "Add BT_HDR length check for received AVCTP packets" into oc-dev am: 51a4b8da 

am: 6309ec7a

Change-Id: I8d5638c89b226dc8a20d9287cfe80e687542621f
parents 340832fd 6309ec7a

system/stack/avct/avct_bcb_act.cc

+6 −0
Original line number Diff line number Diff line
@@ -69,6 +69,12 @@ static BT_HDR* avct_bcb_msg_asmbl(UNUSED_ATTR tAVCT_BCB* p_bcb, BT_HDR* p_buf) { 
  uint8_t* p;

  uint8_t pkt_type;



  if (p_buf->len == 0) {

    osi_free_and_reset((void**)&p_buf);

    android_errorWriteLog(0x534e4554, "79944113");

    return nullptr;

  }



  /* parse the message header */

  p = (uint8_t*)(p_buf + 1) + p_buf->offset;

  pkt_type = AVCT_PKT_TYPE(p);