Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 33334f0d authored by Hui Peng's avatar Hui Peng
Browse files

Add validation on sdp attributes in bta_ag_sdp.cc 

Bug: 263958603
Test: atest bt_host_test_bta
Ignore-AOSP-First: security
Tag: #security
Change-Id: I51c0215125808102b6cff880357d19012ffc37b9
Merged-In: I51c0215125808102b6cff880357d19012ffc37b9
(cherry picked from commit 509feb84)
parent b7c4b272

system/bta/ag/bta_ag_sdp.cc

+6 −2
Original line number Original line Diff line number Diff line
@@ -358,7 +358,9 @@ bool bta_ag_sdp_find_attr(tBTA_AG_SCB* p_scb, tBTA_SERVICE_MASK service) { 
      }

      }

      /* get features if HFP */

      /* get features if HFP */

      p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_SUPPORTED_FEATURES);

      p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_SUPPORTED_FEATURES);

      if (p_attr != nullptr) {

      if (p_attr != nullptr &&

          SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&

          SDP_DISC_ATTR_LEN(p_attr->attr_len_type) >= 2) {

        /* Found attribute. Get value. */

        /* Found attribute. Get value. */

        /* There might be race condition between SDP and BRSF.  */

        /* There might be race condition between SDP and BRSF.  */

        /* Do not update if we already received BRSF.           */

        /* Do not update if we already received BRSF.           */
@@ -395,7 +397,9 @@ bool bta_ag_sdp_find_attr(tBTA_AG_SCB* p_scb, tBTA_SERVICE_MASK service) { 
      /* get features if HSP */

      /* get features if HSP */

      p_attr =

      p_attr =

          SDP_FindAttributeInRec(p_rec, ATTR_ID_REMOTE_AUDIO_VOLUME_CONTROL);

          SDP_FindAttributeInRec(p_rec, ATTR_ID_REMOTE_AUDIO_VOLUME_CONTROL);

      if (p_attr != nullptr) {

      if (p_attr != nullptr &&

            SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == BOOLEAN_DESC_TYPE &&

            SDP_DISC_ATTR_LEN(p_attr->attr_len_type) >= 1) {

        /* Remote volume control of HSP */

        /* Remote volume control of HSP */

        if (p_attr->attr_value.v.u8)

        if (p_attr->attr_value.v.u8)

          p_scb->peer_features |= BTA_AG_PEER_FEAT_VOL;

          p_scb->peer_features |= BTA_AG_PEER_FEAT_VOL;