Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 93389ebd authored by Hui Peng's avatar Hui Peng Committed by Automerger Merge Worker
Browse files

Fix an OOB read in avdt_scb_hdl_pkt_no_frag am: 89255db5 

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/20657353



Change-Id: I2949688ed9f55fe6136cc31fa2fb328b5de9be2e
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 6d687985 89255db5

system/stack/avdt/avdt_scb_act.cc

+3 −3
Original line number Diff line number Diff line
@@ -262,7 +262,7 @@ void avdt_scb_hdl_pkt_no_frag(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) { 
    p += ex_len * 4;

  }



  if ((p - p_start) > len) {

  if ((p - p_start) >= len) {

    android_errorWriteLog(0x534e4554, "142546355");

    osi_free_and_reset((void**)&p_data->p_pkt);

    return;
@@ -272,11 +272,11 @@ void avdt_scb_hdl_pkt_no_frag(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) { 
  /* adjust length for any padding at end of packet */

  if (o_p) {

    /* padding length in last byte of packet */

    pad_len = *(p_start + len);

    pad_len = *(p_start + len - 1);

  }



  /* do sanity check */

  if (pad_len > (len - offset)) {

  if (pad_len >= (len - offset)) {

    AVDT_TRACE_WARNING("Got bad media packet");

    osi_free_and_reset((void**)&p_data->p_pkt);

  }