Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b2a66cfb authored by Pavlin Radoslavov's avatar Pavlin Radoslavov
Browse files

DO NOT MERGE: Add missing AVRCP message length checks inside avrc_msg_cback 

Explicitly check the length of the received message before
accessing the data.

Bug: 111803925
Bug: 79883824
Test: POC scripts
Change-Id: I50d1d1f7dd7038ffcd5f0d5975ab1db43178067f
Merged-In: I00b1c6bd6dd7e18ac2c469ef2032c7ff10dcaecb
parent 88883058

system/stack/avrc/avrc_api.c

+27 −0
Original line number Diff line number Diff line
@@ -24,6 +24,8 @@ 
#include <assert.h>

#include <string.h>



#include <log/log.h>



#include "bt_common.h"

#include "avrc_api.h"

#include "avrc_int.h"
@@ -565,6 +567,13 @@ static void avrc_msg_cback(UINT8 handle, UINT8 label, UINT8 cr, 
    p_data  = (UINT8 *)(p_pkt+1) + p_pkt->offset;

    memset(&msg, 0, sizeof(tAVRC_MSG) );

    {

        if (p_pkt->len < AVRC_AVC_HDR_SIZE) {

            android_errorWriteLog(0x534e4554, "111803925");

            AVRC_TRACE_WARNING("%s: message length %d too short: must be at least %d",

                               __func__, p_pkt->len, AVRC_AVC_HDR_SIZE);

            osi_free(p_pkt);

            return;

        }

        msg.hdr.ctype           = p_data[0] & AVRC_CTYPE_MASK;

        AVRC_TRACE_DEBUG("avrc_msg_cback handle:%d, ctype:%d, offset:%d, len: %d",

                handle, msg.hdr.ctype, p_pkt->offset, p_pkt->len);
@@ -603,6 +612,15 @@ static void avrc_msg_cback(UINT8 handle, UINT8 label, UINT8 cr, 
            else

            {

                /* parse response */

                if (p_pkt->len < AVRC_OP_UNIT_INFO_RSP_LEN) {

                    AVRC_TRACE_WARNING(

                        "%s: message length %d too short: must be at least %d",

                        __func__, p_pkt->len, AVRC_OP_UNIT_INFO_RSP_LEN);

                    android_errorWriteLog(0x534e4554, "79883824");

                    drop = TRUE;

                    p_drop_msg = "UNIT_INFO_RSP too short";

                    break;

                }

                p_data += 4; /* 3 bytes: ctype, subunit*, opcode + octet 3 (is 7)*/

                msg.unit.unit_type  = (*p_data & AVRC_SUBTYPE_MASK) >> AVRC_SUBTYPE_SHIFT;

                msg.unit.unit       = *p_data & AVRC_SUBID_MASK;
@@ -634,6 +652,15 @@ static void avrc_msg_cback(UINT8 handle, UINT8 label, UINT8 cr, 
            else

            {

                /* parse response */

                if (p_pkt->len < AVRC_OP_SUB_UNIT_INFO_RSP_LEN) {

                    AVRC_TRACE_WARNING(

                        "%s: message length %d too short: must be at least %d",

                        __func__, p_pkt->len, AVRC_OP_SUB_UNIT_INFO_RSP_LEN);

                    android_errorWriteLog(0x534e4554, "79883824");

                    drop = TRUE;

                    p_drop_msg = "SUB_UNIT_INFO_RSP too short";

                    break;

                }

                p_data += AVRC_AVC_HDR_SIZE; /* 3 bytes: ctype, subunit*, opcode */

                msg.sub.page    = (*p_data++ >> AVRC_SUB_PAGE_SHIFT) & AVRC_SUB_PAGE_MASK;

                xx      = 0;