Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f6ddce1c authored by Hansong Zhang's avatar Hansong Zhang Committed by android-build-team Robot
Browse files

avrc_copy_packet: Zero initialize packet 

Bug: 174149901
Change-Id: Iefa41749ebbacd34afaa24131de7ee25d706e23f
Tag: Security
Test: POC
(cherry picked from commit 4b937595)
(cherry picked from commit b6862adb)
parent 426adc8d

system/stack/avrc/avrc_api.cc

+1 −1
Original line number Diff line number Diff line
@@ -237,7 +237,7 @@ static uint8_t* avrc_get_data_ptr(BT_HDR* p_pkt) { 
static BT_HDR* avrc_copy_packet(BT_HDR* p_pkt, int rsp_pkt_len) {

  const int offset = MAX(AVCT_MSG_OFFSET, p_pkt->offset);

  const int pkt_len = MAX(rsp_pkt_len, p_pkt->len);

  BT_HDR* p_pkt_copy = (BT_HDR*)osi_malloc(BT_HDR_SIZE + offset + pkt_len);

  BT_HDR* p_pkt_copy = (BT_HDR*)osi_calloc(BT_HDR_SIZE + offset + pkt_len);



  /* Copy the packet header, set the new offset, and copy the payload */

  memcpy(p_pkt_copy, p_pkt, BT_HDR_SIZE);