Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b044aa4a authored by Ted Wang's avatar Ted Wang Committed by android-build-team Robot
Browse files

Fix potential OOB write in libbluetooth 

Check event id if of register notification command from remote to avoid
OOB write.

Tag: #security
Bug: 168802990
Test: atest net_test_btif

Change-Id: I90834b920d61bfb2df9414a25d73ba40033e4748
Merged-In: I90834b920d61bfb2df9414a25d73ba40033e4748
(cherry picked from commit c3e39949)
parent 84b8a2d5

system/stack/avrc/avrc_pars_tg.cc

+7 −0
Original line number Diff line number Diff line
@@ -306,6 +306,13 @@ static tAVRC_STS avrc_pars_vendor_cmd(tAVRC_MSG_VENDOR* p_msg, 
        return AVRC_STS_INTERNAL_ERR;

      else {

        BE_STREAM_TO_UINT8(p_result->reg_notif.event_id, p);

        if (!AVRC_IS_VALID_EVENT_ID(p_result->reg_notif.event_id)) {

          android_errorWriteLog(0x534e4554, "168802990");

          AVRC_TRACE_ERROR("%s: Invalid event id: %d", __func__,

                           p_result->reg_notif.event_id);

          return AVRC_STS_BAD_PARAM;

        }



        BE_STREAM_TO_UINT32(p_result->reg_notif.param, p);

      }

      break;