Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f7679c19 authored by Hui Peng's avatar Hui Peng
Browse files

Fix an OOB bug in on_iso_link_quality_read 

Bug: 260568750
Test: manual
Tag: #security
Ignore-AOSP-First: security
Merged-In: I58b259541a507d65271c4e8b61fcd878a3f90ec0
Change-Id: I58b259541a507d65271c4e8b61fcd878a3f90ec0
parent 45e8d2dc

system/stack/btm/btm_iso_impl.h

+7 −0
Original line number Diff line number Diff line
@@ -353,6 +353,13 @@ struct iso_impl { 
    uint32_t rxUnreceivedPackets;

    uint32_t duplicatePackets;



    // 1 + 2 + 4 * 7

#define ISO_LINK_QUALITY_SIZE 31

    if (len < ISO_LINK_QUALITY_SIZE) {

      LOG(ERROR) << "Malformated link quality format, len=" << len;

      return;

    }



    STREAM_TO_UINT8(status, stream);

    if (status != HCI_SUCCESS) {

      LOG(ERROR) << "Failed to Read ISO Link Quality, status: "