Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a38ce0c8 authored by Hui Peng's avatar Hui Peng Committed by Automerger Merge Worker
Browse files

Merge "Fix an OOB bug in bnepu_process_peer_multicast_filter_set" into main am: da3e225a 

Original change: https://android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/2786446



Change-Id: I8be0584ddfad94c48841bf0636f1652cd39603ad
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 6f67790d da3e225a

system/stack/bnep/bnep_utils.cc

+4 −3
Original line number Diff line number Diff line
@@ -1076,11 +1076,12 @@ void bnepu_process_peer_multicast_filter_set(tBNEP_CONN* p_bcb, 
  }



  p_bcb->rcvd_mcast_filters = num_filters;

  p_temp_filters = p_filters;

  for (xx = 0; xx < num_filters; xx++) {

    memcpy(p_bcb->rcvd_mcast_filter_start[xx].address, p_filters, BD_ADDR_LEN);

    memcpy(p_bcb->rcvd_mcast_filter_end[xx].address, p_filters + BD_ADDR_LEN,

    memcpy(p_bcb->rcvd_mcast_filter_start[xx].address, p_temp_filters, BD_ADDR_LEN);

    memcpy(p_bcb->rcvd_mcast_filter_end[xx].address, p_temp_filters + BD_ADDR_LEN,

           BD_ADDR_LEN);

    p_filters += (BD_ADDR_LEN * 2);

    p_temp_filters += (BD_ADDR_LEN * 2);



    /* Check if any of the ranges have all zeros as both starting and ending

     * addresses */