Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e5db1de7 authored by Hui Peng's avatar Hui Peng Committed by Automerger Merge Worker
Browse files

Merge "Fix a potential OOB read resulted from integer underflow" into tm-dev am: 0e1b29ee 

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/20683540



Change-Id: Ib6fa152eec99e08299fd9d14244180279360e27b
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents c88c328b 0e1b29ee

system/stack/a2dp/a2dp_vendor_ldac.cc

+5 −0
Original line number Original line Diff line number Diff line
@@ -518,6 +518,11 @@ bool A2DP_VendorBuildCodecHeaderLdac(UNUSED_ATTR const uint8_t* p_codec_info, 
                                     uint16_t frames_per_packet) {

                                     uint16_t frames_per_packet) {

  uint8_t* p;

  uint8_t* p;





  // there is a 4 byte timestamp right following p_buf

  if (p_buf->offset < 4 + A2DP_LDAC_MPL_HDR_LEN) {

    return false;

  }



  p_buf->offset -= A2DP_LDAC_MPL_HDR_LEN;

  p_buf->offset -= A2DP_LDAC_MPL_HDR_LEN;

  p = (uint8_t*)(p_buf + 1) + p_buf->offset;

  p = (uint8_t*)(p_buf + 1) + p_buf->offset;

  p_buf->len += A2DP_LDAC_MPL_HDR_LEN;

  p_buf->len += A2DP_LDAC_MPL_HDR_LEN;