Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit 89255db5 authored by Hui Peng's avatar Hui Peng
Browse files

Fix an OOB read in avdt_scb_hdl_pkt_no_frag

The current implementation uses `pad_len = *(p_start + len);`
to read the last byte from the packet, resulting one-byte
out-of-bound read.

Also avdt_scb_hdl_pkt_no_frag passes zero-lenth packets to
upper-layer, this patch adds code to detect such packets
and err out if detected.

The regression test is I9c87e30ed58e7ad6a34ab7c96b0a8fb06324ad54

Bug: 258057241
Test: atest net_test_stack_avdtp
Ignore-AOSP-First: security
Merged-In: If0c7b25f2e6cb4531bbb6254e176e8ad1b5c5fb4
Change-Id: If0c7b25f2e6cb4531bbb6254e176e8ad1b5c5fb4
parent eac401d9
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment