Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 509feb84 authored by Hui Peng's avatar Hui Peng
Browse files

Add validation on sdp attributes in bta_ag_sdp.cc 

Bug: 263958603
Test: atest bt_host_test_bta
Ignore-AOSP-First: security
Tag: #security
Change-Id: I51c0215125808102b6cff880357d19012ffc37b9
parent 3bd9e5b1

system/bta/ag/bta_ag_sdp.cc

+6 −2
Original line number Diff line number Diff line
@@ -404,7 +404,9 @@ bool bta_ag_sdp_find_attr(tBTA_AG_SCB* p_scb, tBTA_SERVICE_MASK service) { 
      /* get features if HFP */

      p_attr = get_legacy_stack_sdp_api()->record.SDP_FindAttributeInRec(

          p_rec, ATTR_ID_SUPPORTED_FEATURES);

      if (p_attr != nullptr) {

      if (p_attr != nullptr &&

          SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&

          SDP_DISC_ATTR_LEN(p_attr->attr_len_type) >= 2) {

        /* Found attribute. Get value. */

        /* There might be race condition between SDP and BRSF.  */

        /* Do not update if we already received BRSF.           */
@@ -447,7 +449,9 @@ bool bta_ag_sdp_find_attr(tBTA_AG_SCB* p_scb, tBTA_SERVICE_MASK service) { 
      /* get features if HSP */

      p_attr = get_legacy_stack_sdp_api()->record.SDP_FindAttributeInRec(

          p_rec, ATTR_ID_REMOTE_AUDIO_VOLUME_CONTROL);

      if (p_attr != nullptr) {

      if (p_attr != nullptr &&

            SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == BOOLEAN_DESC_TYPE &&

            SDP_DISC_ATTR_LEN(p_attr->attr_len_type) >= 1) {

        /* Remote volume control of HSP */

        if (p_attr->attr_value.v.u8)

          p_scb->peer_features |= BTA_AG_PEER_FEAT_VOL;