Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 22a81842 authored by Hui Peng's avatar Hui Peng
Browse files

Fix a few OOB issues in GetAllRsiFromAdvertising 

- OOB access in GetFieldByType
- OOB access in STREAM Op

May need to go to AOSP

Bug: 264624283
Test: manual
Ignore-AOSP-First: security
Change-Id: I2269fd9651cc0dff734787403b8488fdf03c87a2
parent aa14e3be

system/bta/csis/csis_client.cc

+6 −1
Original line number Diff line number Diff line
@@ -1150,7 +1150,12 @@ class CsisClientImpl : public CsisClient { 
                    service_data_len,

                BTM_BLE_AD_TYPE_RSI, &service_data_len))) {

      RawAddress bda;

      STREAM_TO_BDADDR(bda, p_service_data);

      const uint8_t *p_bda = p_service_data;

      if (service_data_len < RawAddress::kLength) {

          continue;

      }



      STREAM_TO_BDADDR(bda, p_bda);

      devices.push_back(std::move(bda));

    }