Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8e3b3fc9 authored by Hui Peng's avatar Hui Peng Committed by Android Build Coastguard Worker
Browse files

Fix 2 OOB bugs in CreateAudioBroadcast 

Bug: 275340684
Bug: 282234870
Test: manual
Ignore-AOSP-First: security
Tag: #security
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:5f9059acdfed500ea5ff4b159795280d5fa2ecbf)
Merged-In: Ia8e9c3a3e534f419b6bd6c902a35d2caf4c7727b
Change-Id: Ia8e9c3a3e534f419b6bd6c902a35d2caf4c7727b
parent cbb30d72

system/bta/le_audio/broadcaster/broadcaster.cc

+9 −0
Original line number Diff line number Diff line
@@ -426,6 +426,10 @@ class LeAudioBroadcasterImpl : public LeAudioBroadcaster, public BigCallbacks { 
        auto stream_context_vec = ltv.Find(

            le_audio::types::kLeAudioMetadataTypeStreamingAudioContext);

        if (stream_context_vec) {

          if (stream_context_vec.value().size() < 2) {

            LOG_ERROR("kLeAudioMetadataTypeStreamingAudioContext size < 2");

            return;

          }

          auto pp = stream_context_vec.value().data();

          UINT16_TO_STREAM(pp, context_type.value());

        }
@@ -434,6 +438,11 @@ class LeAudioBroadcasterImpl : public LeAudioBroadcaster, public BigCallbacks { 
      auto stream_context_vec =

          ltv.Find(le_audio::types::kLeAudioMetadataTypeStreamingAudioContext);

      if (stream_context_vec) {

        if (stream_context_vec.value().size() < 2) {

          LOG_ERROR("kLeAudioMetadataTypeStreamingAudioContext size < 2");

          return;

        }



        auto pp = stream_context_vec.value().data();

        STREAM_TO_UINT16(context_type.value_ref(), pp);

      }