Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d140b30e authored by Ted Wang's avatar Ted Wang Committed by Automerger Merge Worker
Browse files

Merge "Add length check when copy AVDTP packet" into tm-dev am: 851a2d15 

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/19500904



Change-Id: I0d14f8de8bcf10f93894980cbcb42b6d232a4eb3
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 25b41157 851a2d15

system/stack/avdt/avdt_msg.cc

+4 −0
Original line number Diff line number Diff line
@@ -1252,6 +1252,10 @@ BT_HDR* avdt_msg_asmbl(AvdtpCcb* p_ccb, BT_HDR* p_buf) { 
     * would have allocated smaller buffer.

     */

    p_ccb->p_rx_msg = (BT_HDR*)osi_malloc(BT_DEFAULT_BUFFER_SIZE);

    if (sizeof(BT_HDR) + p_buf->offset + p_buf->len > BT_DEFAULT_BUFFER_SIZE) {

      android_errorWriteLog(0x534e4554, "232023771");

      return NULL;

    }

    memcpy(p_ccb->p_rx_msg, p_buf, sizeof(BT_HDR) + p_buf->offset + p_buf->len);



    /* Free original buffer */