Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 907d720e authored by Hui Peng's avatar Hui Peng Committed by Android (Google) Code Review
Browse files

Merge changes I2e026025,I45320085 

* changes:
  Add regression test for b/186803518
  Fix an OOB access bug in A2DP_BuildMediaPayloadHeaderSbc
parents af64746a 46dc2f11

system/stack/Android.bp

+1 −0
Original line number Diff line number Diff line
@@ -747,6 +747,7 @@ cc_test { 
        "a2dp/a2dp_vendor_opus_decoder.cc",

        "test/a2dp/a2dp_aac_unittest.cc",

        "test/a2dp/a2dp_sbc_unittest.cc",

        "test/a2dp/a2dp_sbc_regression_tests.cc",

        "test/a2dp/a2dp_opus_unittest.cc",

        "test/a2dp/a2dp_vendor_ldac_unittest.cc",

        "test/a2dp/mock_bta_av_codec.cc",

system/stack/a2dp/a2dp_sbc.cc

+4 −0
Original line number Diff line number Diff line
@@ -696,6 +696,10 @@ bool A2DP_BuildCodecHeaderSbc(UNUSED_ATTR const uint8_t* p_codec_info, 
    return false;

  }



  if (p_buf->offset < A2DP_SBC_MPL_HDR_LEN) {

    return false;

  }



  p_buf->offset -= A2DP_SBC_MPL_HDR_LEN;

  uint8_t* p = (uint8_t*)(p_buf + 1) + p_buf->offset;

  p_buf->len += A2DP_SBC_MPL_HDR_LEN;

system/stack/test/a2dp/a2dp_sbc_regression_tests.cc

0 → 100644
+40 −0
Original line number Diff line number Diff line 
/*

 * Copyright 2022 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *      http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */



#include <gtest/gtest.h>



#include <cstring>



#include "a2dp_sbc.h"



namespace bluetooth {

namespace testing {



class A2DPRegressionTests : public ::testing::Test {

 protected:

  void SetUp() override {}

  void TearDown() override {}

};



// regression test for b/186803518

TEST_F(A2DPRegressionTests, OOB_In_A2DP_BuildCodecHeaderSbc) {

  BT_HDR hdr{};

  hdr.len = sizeof(BT_HDR);

  A2DP_BuildCodecHeaderSbc(nullptr, &hdr, 0);

}



}  // namespace testing

}  // namespace bluetooth