Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4c29ea05 authored by Jakub Pawlowski's avatar Jakub Pawlowski
Browse files

SDP_AddAttribute: fix potential OOB reads 

Don't log SDP strings when they are not null terminated.
Same for values of Reserved type.

Bug: 170309700
Test: run a2dp_fuzz
Ignore-AOSP-First: see b/170309700
Change-Id: Id281c85a0184ae993630851b0d21897d073ff4dc
parent 5a6cd6ec

system/stack/sdp/sdp_db.cc

+14 −3
Original line number Diff line number Diff line
@@ -372,11 +372,22 @@ bool SDP_AddAttribute(uint32_t handle, uint16_t attr_id, uint8_t attr_type, 
          "SDP_AddAttribute: handle:%X, id:%04X, type:%d, len:%d, p_val:%p, "

          "*p_val:%d",

          handle, attr_id, attr_type, attr_len, p_val, *p_val);

    } else {

    } else if ((attr_type == TEXT_STR_DESC_TYPE) ||

               (attr_type == URL_DESC_TYPE)) {

      if (p_val[attr_len - 1] == '\0') {

        SDP_TRACE_DEBUG(

            "SDP_AddAttribute: handle:%X, id:%04X, type:%d, len:%d, p_val:%p, "

            "*p_val:%s",

          handle, attr_id, attr_type, attr_len, p_val, p_val);

            handle, attr_id, attr_type, attr_len, p_val, *p_val);

      } else {

        SDP_TRACE_DEBUG(

            "SDP_AddAttribute: handle:%X, id:%04X, type:%d, len:%d, p_val:%p",

            handle, attr_id, attr_type, attr_len, p_val);

      }

    } else {

      SDP_TRACE_DEBUG(

          "SDP_AddAttribute: handle:%X, id:%04X, type:%d, len:%d, p_val:%p",

          handle, attr_id, attr_type, attr_len, p_val);

    }

  }