Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 47d9d69b authored by Hui Peng's avatar Hui Peng Committed by Automerger Merge Worker
Browse files

Add validation on attr type and size in a2dp_api.cc am: c5bc4c49 am: 414874c6 am: f77f5a5e 

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/24638582



Change-Id: Iae516d5aaee5284059aae895781745adc7b01c28
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 00dc344d f77f5a5e

system/stack/a2dp/a2dp_api.cc

+25 −7
Original line number Diff line number Diff line
@@ -88,23 +88,41 @@ static void a2dp_sdp_cback(tSDP_STATUS status) { 
      peer_address = p_rec->remote_bd_addr;



      /* get service name */

      if ((p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_SERVICE_NAME)) !=

          NULL) {

      if ((p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_SERVICE_NAME)) != NULL) {

        if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == TEXT_STR_DESC_TYPE) {

          a2dp_svc.p_service_name = (char*)p_attr->attr_value.v.array;

          a2dp_svc.service_len = SDP_DISC_ATTR_LEN(p_attr->attr_len_type);

        } else {

          LOG_ERROR("ATTR_ID_SERVICE_NAME attr type not STR!!");

        }

      } else {

        LOG_ERROR("ATTR_ID_SERVICE_NAME attr not found!!");

      }



      /* get provider name */

      if ((p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_PROVIDER_NAME)) !=

          NULL) {

        if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == TEXT_STR_DESC_TYPE) {

          a2dp_svc.p_provider_name = (char*)p_attr->attr_value.v.array;

          a2dp_svc.provider_len = SDP_DISC_ATTR_LEN(p_attr->attr_len_type);

        } else {

          LOG_ERROR("ATTR_ID_PROVIDER_NAME attr type not STR!!");

        }

      } else {

        LOG_ERROR("ATTR_ID_PROVIDER_NAME attr not found!!");

      }



      /* get supported features */

      if ((p_attr = SDP_FindAttributeInRec(

               p_rec, ATTR_ID_SUPPORTED_FEATURES)) != NULL) {

        if (SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&

            SDP_DISC_ATTR_LEN(p_attr->attr_len_type) == 2) {

          a2dp_svc.features = p_attr->attr_value.v.u16;

        } else {

          LOG_ERROR("ATTR_ID_SUPPORTED_FEATURES attr type not STR!!");

        }

      } else {

        LOG_ERROR("ATTR_ID_SUPPORTED_FEATURES attr not found!!");

      }



      /* get AVDTP version */