Merge "Fix OOB in avct_lcb_msg_asmbl" (481b89c0) · Commits · e / os / android_packages_modules_Bluetooth

system/stack/avct/avct_lcb_act.cc

+6 −0

Original line number	Diff line number	Diff line
		@@ -53,6 +53,12 @@ static BT_HDR* avct_lcb_msg_asmbl(tAVCT_LCB* p_lcb, BT_HDR* p_buf) {
		uint8_t pkt_type;
		BT_HDR* p_ret;

		if (p_buf->len < 1) {
		osi_free(p_buf);
		p_ret = NULL;
		return p_ret;
		}

		/* parse the message header */
		p = (uint8_t*)(p_buf + 1) + p_buf->offset;
		pkt_type = AVCT_PKT_TYPE(p);