Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7de61cea authored by Ted Wang's avatar Ted Wang Committed by Android Build Coastguard Worker
Browse files

Add length check when copy AVDTP packet 

Bug: 232023771
Test: make
Tag: #security
Ignore-AOSP-First: Security
Change-Id: I68dd78c747eeafee5190dc56d7c71e9eeed08a5b
(cherry picked from commit 9f083ec9)
Merged-In: I68dd78c747eeafee5190dc56d7c71e9eeed08a5b
parent c8b74c82

system/stack/avdt/avdt_msg.cc

+4 −0
Original line number Diff line number Diff line
@@ -1258,6 +1258,10 @@ BT_HDR* avdt_msg_asmbl(AvdtpCcb* p_ccb, BT_HDR* p_buf) { 
      return p_ret;

    }

    p_ccb->p_rx_msg = (BT_HDR*)osi_malloc(BT_DEFAULT_BUFFER_SIZE);

    if (sizeof(BT_HDR) + p_buf->offset + p_buf->len > BT_DEFAULT_BUFFER_SIZE) {

      android_errorWriteLog(0x534e4554, "232023771");

      return NULL;

    }

    memcpy(p_ccb->p_rx_msg, p_buf, sizeof(BT_HDR) + p_buf->offset + p_buf->len);



    /* Free original buffer */