Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5f4fa4a0 authored by Hui Peng's avatar Hui Peng
Browse files

Fix 2 OOB bugs in LeAudioBroadcasterImpl::UpdateMetadata 

Bug: 275551881
Test: manual
Ignore-AOSP-First: security
Tag: #security
Merged-In: I6172d11a9c745018ca40e2df8b0e70f4f9728fde
Change-Id: I6172d11a9c745018ca40e2df8b0e70f4f9728fde
parent e3875d07

system/bta/le_audio/broadcaster/broadcaster.cc

+8 −0
Original line number Diff line number Diff line
@@ -277,6 +277,10 @@ class LeAudioBroadcasterImpl : public LeAudioBroadcaster, public BigCallbacks { 
          ltv.Find(le_audio::types::kLeAudioMetadataTypeStreamingAudioContext);

      if (stream_context_vec) {

        auto pp = stream_context_vec.value().data();

        if (stream_context_vec.value().size() < 2) {

          LOG_ERROR("stream_context_vec.value() size < 2");

          return;

        }

        UINT16_TO_STREAM(pp, context_type.value());

      }

    }
@@ -285,6 +289,10 @@ class LeAudioBroadcasterImpl : public LeAudioBroadcaster, public BigCallbacks { 
        ltv.Find(le_audio::types::kLeAudioMetadataTypeStreamingAudioContext);

    if (stream_context_vec) {

      auto pp = stream_context_vec.value().data();

      if (stream_context_vec.value().size() < 2) {

        LOG_ERROR("stream_context_vec.value() size < 2");

        return;

      }

      STREAM_TO_UINT16(context_type.value_ref(), pp);

    }