Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a2ccb20f authored by Hui Peng's avatar Hui Peng
Browse files

Add type validation in bta_hf_client_sdp.cc 

Bug: 263958603
Test: atest net_test_bta
Ignore-AOSP-First: security
Tag: #security

Merged-In: I70a15be0409d9368e1d5984b1719f9a917c8cb7e
Change-Id: I70a15be0409d9368e1d5984b1719f9a917c8cb7e
(cherry picked from commit 3bd9e5b1)
parent b7c4b272

system/bta/hf_client/bta_hf_client_sdp.cc

100755 → 100644
+6 −2
Original line number Diff line number Diff line
@@ -251,7 +251,9 @@ bool bta_hf_client_sdp_find_attr(tBTA_HF_CLIENT_CB* client_cb) { 


    /* get features */

    p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_SUPPORTED_FEATURES);

    if (p_attr != NULL) {

    if (p_attr != NULL &&

        SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&

        SDP_DISC_ATTR_LEN(p_attr->attr_len_type) >= 2) {

      /* Found attribute. Get value. */

      /* There might be race condition between SDP and BRSF.  */

      /* Do not update if we already received BRSF.           */
@@ -266,7 +268,9 @@ bool bta_hf_client_sdp_find_attr(tBTA_HF_CLIENT_CB* client_cb) { 


        /* get network for ability to reject calls */

        p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_NETWORK);

        if (p_attr != NULL) {

        if (p_attr != NULL &&

            SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&

            SDP_DISC_ATTR_LEN(p_attr->attr_len_type) >= 2) {

          if (p_attr->attr_value.v.u16 == 0x01) {

            client_cb->peer_features |= BTA_HF_CLIENT_PEER_REJECT;

          }