Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2685816c authored by Henri Chataing's avatar Henri Chataing
Browse files

RootCanal: Fix OOB reference in IncomingAclPacket 

IncomingAclPacket took an illegal reference to
the end index of a vector.

Bug: 268037653
Test: m root-canal + manual validation
Change-Id: I8b431453256877f9cd173671e4eb7c46a29d57a8
parent a7e4d670

tools/rootcanal/model/controller/link_layer_controller.cc

+2 −2
Original line number Diff line number Diff line
@@ -1842,8 +1842,8 @@ void LinkLayerController::IncomingAclPacket( 
    size_t start_index = acl_buffer_size * i;

    size_t end_index =

        std::min(start_index + acl_buffer_size, payload_data.size());

    std::vector<uint8_t> fragment(&payload_data[start_index],

                                  &payload_data[end_index]);

    std::vector<uint8_t> fragment(payload_data.begin() + start_index,

                                  payload_data.begin() + end_index);

    std::unique_ptr<bluetooth::packet::RawBuilder> raw_builder_ptr =

        std::make_unique<bluetooth::packet::RawBuilder>(fragment);

    auto acl_packet = bluetooth::hci::AclBuilder::Create(