Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 72e17e42 authored by Ted Wang's avatar Ted Wang
Browse files

Fix OOB in avdt_msg_asmbl 

Bug: 78287084
Test: manual
Change-Id: I83fef3d9702ddf8aa951509f2bb261dce1cb90de
parent 5ac2b8da

system/stack/avdt/avdt_msg.cc

+8 −0
Original line number Diff line number Diff line
@@ -1191,6 +1191,14 @@ BT_HDR* avdt_msg_asmbl(AvdtpCcb* p_ccb, BT_HDR* p_buf) { 


  /* parse the message header */

  p = (uint8_t*)(p_buf + 1) + p_buf->offset;



  /* Check if is valid length */

  if (p_buf->len < 1) {

    android_errorWriteLog(0x534e4554, "78287084");

    osi_free(p_buf);

    p_ret = NULL;

    return p_ret;

  }

  AVDT_MSG_PRS_PKT_TYPE(p, pkt_type);



  /* quick sanity check on length */