Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f44d25b9 authored by Hui Peng's avatar Hui Peng Committed by Automerger Merge Worker
Browse files

Fix an OOB read in avdt_scb_hdl_pkt_no_frag am: 219be8a4 

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/20715672



Change-Id: Ia535a34e5669aa9422992b44ace079481f45cf48
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents e69ef92c 219be8a4

system/stack/avdt/avdt_scb_act.cc

+3 −3
Original line number Diff line number Diff line
@@ -262,7 +262,7 @@ void avdt_scb_hdl_pkt_no_frag(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) { 
    p += ex_len * 4;

  }



  if ((p - p_start) > len) {

  if ((p - p_start) >= len) {

    osi_free_and_reset((void**)&p_data->p_pkt);

    return;

  }
@@ -271,11 +271,11 @@ void avdt_scb_hdl_pkt_no_frag(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) { 
  /* adjust length for any padding at end of packet */

  if (o_p) {

    /* padding length in last byte of packet */

    pad_len = *(p_start + len);

    pad_len = *(p_start + len - 1);

  }



  /* do sanity check */

  if (pad_len > (len - offset)) {

  if (pad_len >= (len - offset)) {

    AVDT_TRACE_WARNING("Got bad media packet");

    osi_free_and_reset((void**)&p_data->p_pkt);

  }