Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2767244e authored by Chienyuan's avatar Chienyuan
Browse files

Fix OOB in avdt_msg_prs_cfg 

Bug: 112272279
Test: PoC
Change-Id: I2748da7dc120f843e7282c8328e6900d2ceb90ff
parent ef4b27e0

system/stack/avdt/avdt_msg.cc

+8 −0
Original line number Diff line number Diff line
@@ -586,6 +586,10 @@ static uint8_t avdt_msg_prs_cfg(AvdtpSepConfig* p_cfg, uint8_t* p, uint16_t len, 
    /* parse individual information elements with additional parameters */

    switch (elem) {

      case AVDT_CAT_RECOV:

        if ((p_end - p) < 3) {

          err = AVDT_ERR_PAYLOAD;

          break;

        }

        p_cfg->recov_type = *p++;

        p_cfg->recov_mrws = *p++;

        p_cfg->recov_mnmp = *p++;
@@ -617,6 +621,10 @@ static uint8_t avdt_msg_prs_cfg(AvdtpSepConfig* p_cfg, uint8_t* p, uint16_t len, 
        break;



      case AVDT_CAT_HDRCMP:

        if ((p_end - p) < 1) {

          err = AVDT_ERR_PAYLOAD;

          break;

        }

        p_cfg->hdrcmp_mask = *p++;

        break;