Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 53bd46fd authored by Hui Peng's avatar Hui Peng Committed by Android (Google) Code Review
Browse files

Merge changes I8bdaf3fe,I4744169d 

* changes:
  Regression test for 259704719
  Fix a potential OOB read resulted from integer underflow
parents 89301068 737c82a1

system/stack/Android.bp

+1 −0
Original line number Diff line number Diff line
@@ -750,6 +750,7 @@ cc_test { 
        "test/a2dp/a2dp_sbc_regression_tests.cc",

        "test/a2dp/a2dp_opus_unittest.cc",

        "test/a2dp/a2dp_vendor_ldac_unittest.cc",

        "test/a2dp/a2dp_vendor_regression_tests.cc",

        "test/a2dp/mock_bta_av_codec.cc",

        "test/a2dp/test_util.cc",

        "test/a2dp/wav_reader.cc",

system/stack/a2dp/a2dp_vendor_ldac.cc

+4 −0
Original line number Diff line number Diff line
@@ -518,6 +518,10 @@ bool A2DP_VendorBuildCodecHeaderLdac(UNUSED_ATTR const uint8_t* p_codec_info, 
                                     uint16_t frames_per_packet) {

  uint8_t* p;



  if (p_buf->offset < A2DP_LDAC_MPL_HDR_LEN) {

    return false;

  }



  p_buf->offset -= A2DP_LDAC_MPL_HDR_LEN;

  p = (uint8_t*)(p_buf + 1) + p_buf->offset;

  p_buf->len += A2DP_LDAC_MPL_HDR_LEN;

system/stack/a2dp/a2dp_vendor_opus.cc

+4 −0
Original line number Diff line number Diff line
@@ -566,6 +566,10 @@ bool A2DP_VendorBuildCodecHeaderOpus(UNUSED_ATTR const uint8_t* p_codec_info, 
                                     uint16_t frames_per_packet) {

  uint8_t* p;



  if (p_buf->offset < A2DP_OPUS_MPL_HDR_LEN) {

    return false;

  }



  p_buf->offset -= A2DP_OPUS_MPL_HDR_LEN;

  p = (uint8_t*)(p_buf + 1) + p_buf->offset;

  p_buf->len += A2DP_OPUS_MPL_HDR_LEN;

system/stack/test/a2dp/a2dp_vendor_regression_tests.cc

0 → 100644
+47 −0
Original line number Diff line number Diff line 
/*

 * Copyright 2022 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *      http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */



#include <gtest/gtest.h>



#include "a2dp_vendor_ldac.h"

#include "a2dp_vendor_opus.h"



// namespace

namespace bluetooth {

namespace testing {



class A2DPVendorRegressionTests : public ::testing::Test {

 protected:

  void SetUp() override {}

  void TearDown() override {}

};



// regression test for b/259704719

TEST_F(A2DPVendorRegressionTests, OOB_In_A2DP_VendorBuildCodecHeaderLdac) {

  BT_HDR hdr{};

  hdr.len = sizeof(BT_HDR);

  A2DP_VendorBuildCodecHeaderLdac(nullptr, &hdr, 0);

}



// regression test for b/259704719

TEST_F(A2DPVendorRegressionTests, OOB_In_A2DP_VendorBuildCodecHeaderOpus) {

  BT_HDR hdr{};

  hdr.len = sizeof(BT_HDR);

  A2DP_VendorBuildCodecHeaderOpus(nullptr, &hdr, 0);

}



}  // namespace testing

}  // namespace bluetooth