Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4d786686 authored by Pavlin Radoslavov's avatar Pavlin Radoslavov Committed by android-build-merger
Browse files

Merge "Add checks whether the AVDTP element data length is valid" into oc-dev... 

Merge "Add checks whether the AVDTP element data length is valid" into oc-dev am: e6852c54 am: 1e08027c am: 0a3d3574
am: 03cbad2f

Change-Id: I9b34c14621bd254d373fdf9f8d0612416e6c683b
parents 172f6abd 03cbad2f

system/stack/avdt/avdt_msg.cc

+11 −0
Original line number Diff line number Diff line
@@ -26,6 +26,7 @@ 
 *

 ******************************************************************************/



#include <log/log.h>

#include <string.h>

#include "avdt_api.h"

#include "avdt_int.h"
@@ -600,6 +601,11 @@ static uint8_t avdt_msg_prs_cfg(AvdtpSepConfig* p_cfg, uint8_t* p, uint16_t len, 


      case AVDT_CAT_PROTECT:

        p_cfg->psc_mask &= ~AVDT_PSC_PROTECT;

        if (p + elem_len > p_end) {

          err = AVDT_ERR_LENGTH;

          android_errorWriteLog(0x534e4554, "78288378");

          break;

        }

        if ((elem_len + protect_offset) < AVDT_PROTECT_SIZE) {

          p_cfg->num_protect++;

          p_cfg->protect_info[protect_offset] = elem_len;
@@ -620,6 +626,11 @@ static uint8_t avdt_msg_prs_cfg(AvdtpSepConfig* p_cfg, uint8_t* p, uint16_t len, 
        if (elem_len >= AVDT_CODEC_SIZE) {

          tmp = AVDT_CODEC_SIZE - 1;

        }

        if (p + tmp > p_end) {

          err = AVDT_ERR_LENGTH;

          android_errorWriteLog(0x534e4554, "78288378");

          break;

        }

        p_cfg->num_codec++;

        p_cfg->codec_info[0] = elem_len;

        memcpy(&p_cfg->codec_info[1], p, tmp);