Fix an OOB read in avdt_scb_hdl_pkt_no_frag
The current implementation uses `pad_len = *(p_start + len);` to read the last byte from the packet, resulting one-byte out-of-bound read. Also avdt_scb_hdl_pkt_no_frag passes zero-lenth packets to upper-layer, this patch adds code to detect such packets and err out if detected. The regression test is I9c87e30ed58e7ad6a34ab7c96b0a8fb06324ad54 Bug: 258057241 Test: atest net_test_stack_avdtp Ignore-AOSP-First: security Merged-In: If0c7b25f2e6cb4531bbb6254e176e8ad1b5c5fb4 Change-Id: If0c7b25f2e6cb4531bbb6254e176e8ad1b5c5fb4 (cherry picked from commit 89255db5) Merged-In: If0c7b25f2e6cb4531bbb6254e176e8ad1b5c5fb4
Loading
Please register or sign in to comment