Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit d0377d69 authored by Brian Delwiche's avatar Brian Delwiche Committed by Android Build Coastguard Worker
Browse files

Fix OOB read in add_attr

It is possible in exceptional cases for add_attr to be passed a p
pointer one byte short of its p_end pointer, which leads to an OOB read
as it attempts to read the type of the next attribute.

Add a check for this.

Bug: 367274727
Test: m libbluetooth
Ignore-AOSP-First: security
Tag: security
Flag: EXEMPT trivial validity check
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:c1eb2120b77d71bdccd8eb46e6cfa15c41beae07)
Merged-In: Ic3079c4c2d6933355cf4e8444e8f25ebedeafefe
Change-Id: Ic3079c4c2d6933355cf4e8444e8f25ebedeafefe
parent 09ae4e14
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment