Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d3411b86 authored by TreeHugger Robot's avatar TreeHugger Robot Committed by Android (Google) Code Review
Browse files

Merge "Fix OOB in avdt_msg_prs_cfg"

parents 7f913e04 2767244e

system/stack/avdt/avdt_msg.cc

+8 −0
Original line number Diff line number Diff line
@@ -586,6 +586,10 @@ static uint8_t avdt_msg_prs_cfg(AvdtpSepConfig* p_cfg, uint8_t* p, uint16_t len, 
    /* parse individual information elements with additional parameters */

    switch (elem) {

      case AVDT_CAT_RECOV:

        if ((p_end - p) < 3) {

          err = AVDT_ERR_PAYLOAD;

          break;

        }

        p_cfg->recov_type = *p++;

        p_cfg->recov_mrws = *p++;

        p_cfg->recov_mnmp = *p++;
@@ -617,6 +621,10 @@ static uint8_t avdt_msg_prs_cfg(AvdtpSepConfig* p_cfg, uint8_t* p, uint16_t len, 
        break;



      case AVDT_CAT_HDRCMP:

        if ((p_end - p) < 1) {

          err = AVDT_ERR_PAYLOAD;

          break;

        }

        p_cfg->hdrcmp_mask = *p++;

        break;