Merge "Add bounds check in avdt_scb_act.cc" into tm-dev (eac401d9) · Commits · e / os / android_packages_modules_Bluetooth

system/stack/avdt/avdt_scb_act.cc

+5 −0

Original line number	Diff line number	Diff line
		@@ -1023,6 +1023,11 @@ void avdt_scb_hdl_write_req(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {

		/* Build a media packet, and add an RTP header if required. */
		if (add_rtp_header) {
		if (p_data->apiwrite.p_buf->offset < AVDT_MEDIA_HDR_SIZE) {
		android_errorWriteWithInfoLog(0x534e4554, "242535997", -1, NULL, 0);
		return;
		}

		ssrc = avdt_scb_gen_ssrc(p_scb);

		p_data->apiwrite.p_buf->len += AVDT_MEDIA_HDR_SIZE;