Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 219be8a4 authored by Hui Peng's avatar Hui Peng
Browse files

Fix an OOB read in avdt_scb_hdl_pkt_no_frag 

The current implementation uses `pad_len = *(p_start + len);`
to read the last byte from the packet, resulting one-byte
out-of-bound read.

Also avdt_scb_hdl_pkt_no_frag passes zero-lenth packets to
upper-layer, this patch adds code to detect such packets
and err out if detected.

The regression test is I9c87e30ed58e7ad6a34ab7c96b0a8fb06324ad54

Bug: 258057241
Test: atest net_test_stack_avdtp
Ignore-AOSP-First: security
Merged-In: If0c7b25f2e6cb4531bbb6254e176e8ad1b5c5fb4
Change-Id: If0c7b25f2e6cb4531bbb6254e176e8ad1b5c5fb4
parent 1be97a1f

system/stack/avdt/avdt_scb_act.cc

+3 −3
Original line number Diff line number Diff line
@@ -262,7 +262,7 @@ void avdt_scb_hdl_pkt_no_frag(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) { 
    p += ex_len * 4;

  }



  if ((p - p_start) > len) {

  if ((p - p_start) >= len) {

    osi_free_and_reset((void**)&p_data->p_pkt);

    return;

  }
@@ -271,11 +271,11 @@ void avdt_scb_hdl_pkt_no_frag(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) { 
  /* adjust length for any padding at end of packet */

  if (o_p) {

    /* padding length in last byte of packet */

    pad_len = *(p_start + len);

    pad_len = *(p_start + len - 1);

  }



  /* do sanity check */

  if (pad_len > (len - offset)) {

  if (pad_len >= (len - offset)) {

    AVDT_TRACE_WARNING("Got bad media packet");

    osi_free_and_reset((void**)&p_data->p_pkt);

  }