Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d4c50d11 authored by Hui Peng's avatar Hui Peng
Browse files

Add validation on sdp attributes in bta_av_act.cc 

Bug: 263958603
Test: atest bt_host_test_bta
Ignore-AOSP-First: security
Tag: #security
Merged-In: I5286fabf49f14cba5ef65a79d6e1eadb40bbb514
Change-Id: I5286fabf49f14cba5ef65a79d6e1eadb40bbb514
(cherry picked from commit 590aa47f)
parent b7c4b272

system/bta/av/bta_av_act.cc

+6 −2
Original line number Diff line number Diff line
@@ -1680,7 +1680,9 @@ tBTA_AV_FEAT bta_av_check_peer_features(uint16_t service_uuid) { 
      if (peer_rc_version >= AVRC_REV_1_4) {

        /* get supported categories */

        p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_SUPPORTED_FEATURES);

        if (p_attr != NULL) {

        if (p_attr != NULL &&

            SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&

            SDP_DISC_ATTR_LEN(p_attr->attr_len_type) >= 2) {

          categories = p_attr->attr_value.v.u16;

          if (categories & AVRC_SUPF_CT_CAT2)

            peer_features |= (BTA_AV_FEAT_ADV_CTRL);
@@ -1744,7 +1746,9 @@ tBTA_AV_FEAT bta_avk_check_peer_features(uint16_t service_uuid) { 
      /* Get supported features */

      tSDP_DISC_ATTR* p_attr =

          SDP_FindAttributeInRec(p_rec, ATTR_ID_SUPPORTED_FEATURES);

      if (p_attr != NULL) {

      if (p_attr != NULL &&

          SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&

          SDP_DISC_ATTR_LEN(p_attr->attr_len_type) >= 2) {

        uint16_t categories = p_attr->attr_value.v.u16;

        /*

         * Though Absolute Volume came after in 1.4 and above, but there are