Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d5dd58e1 authored by Ted Wang's avatar Ted Wang Committed by Automerger Merge Worker
Browse files

Merge "Add length check when copy AVDTP packet" into tm-dev am: 851a2d15 am: 0d9058e1 

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/19500904



Change-Id: I8a8260f96cd4f8013307b7a9ae6fd3b5b7007574
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 20f4d8fd 0d9058e1

system/stack/avdt/avdt_msg.cc

+4 −0
Original line number Diff line number Diff line
@@ -1252,6 +1252,10 @@ BT_HDR* avdt_msg_asmbl(AvdtpCcb* p_ccb, BT_HDR* p_buf) { 
     * would have allocated smaller buffer.

     */

    p_ccb->p_rx_msg = (BT_HDR*)osi_malloc(BT_DEFAULT_BUFFER_SIZE);

    if (sizeof(BT_HDR) + p_buf->offset + p_buf->len > BT_DEFAULT_BUFFER_SIZE) {

      android_errorWriteLog(0x534e4554, "232023771");

      return NULL;

    }

    memcpy(p_ccb->p_rx_msg, p_buf, sizeof(BT_HDR) + p_buf->offset + p_buf->len);



    /* Free original buffer */