Commit 423c0285 authored Aug 21, 2023 by Hui Peng Committed by Android Build Coastguard Worker Oct 11, 2023

Fix an OOB bug in parse_gap_data

Bug: 277590580
bug: 275553827
Test: atest net_test_main_shim
Ignore-AOSP-First: security
Tag: #security
(cherry picked from commit 0d7e3d8f)
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:462fc9465fafce4a055d0dadb451b3d71bf05289)
Merged-In: I7fcb7c46f668f48560a72399a3c5087c6da3827f
Change-Id: I7fcb7c46f668f48560a72399a3c5087c6da3827f

parent 8fdf3afd

system/main/shim/utils.cc

+4 −0

Original line number	Diff line number	Diff line
		@@ -25,6 +25,10 @@ void parse_gap_data(const std::vector<uint8_t> &raw_data,
		hci::GapData gap_data;
		uint8_t len = raw_data[offset];

		if (offset + len + 1 > raw_data.size()) {
		break;
		}

		auto begin = raw_data.begin() + offset;
		auto end = begin + len + 1; // 1 byte for len
		auto data_copy = std::make_shared<std::vector<uint8_t>>(begin, end);