diff options
| author | Hui Peng <phui@google.com> | 2022-12-13 19:31:40 +0000 |
|---|---|---|
| committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | 2022-12-13 19:31:40 +0000 |
| commit | bc7a0a509fb2686c66e1d7a1eb2981d367c5de2d (patch) | |
| tree | 7f8390c83448821fb29db21efe5bc34bd1d595ad | |
| parent | a0bba7e24a0b4e935a0217f4ec3722e66cceff9f (diff) | |
| parent | b0b968e8c6214e20a5dc3617d66567225df0884f (diff) | |
| download | bt-bc7a0a509fb2686c66e1d7a1eb2981d367c5de2d.tar.gz | |
Fix OOB access in avdt_scb_hdl_pkt_no_frag am: b0b968e8c6
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/bt/+/20672923
Change-Id: I9da437890501946b0a793001c7b5c8b11e7e53dc
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
| -rw-r--r-- | stack/avdt/avdt_scb_act.cc | 13 |
1 files changed, 9 insertions, 4 deletions
diff --git a/stack/avdt/avdt_scb_act.cc b/stack/avdt/avdt_scb_act.cc index ce53c45eb..f2de4ba35 100644 --- a/stack/avdt/avdt_scb_act.cc +++ b/stack/avdt/avdt_scb_act.cc @@ -255,19 +255,24 @@ void avdt_scb_hdl_pkt_no_frag(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) { if (offset > len) goto length_error; p += 2; BE_STREAM_TO_UINT16(ex_len, p); - offset += ex_len * 4; p += ex_len * 4; } + if ((p - p_start) >= len) { + AVDT_TRACE_WARNING("%s: handling malformatted packet: ex_len too large", __func__); + osi_free_and_reset((void**)&p_data->p_pkt); + return; + } + offset = p - p_start; + /* adjust length for any padding at end of packet */ if (o_p) { /* padding length in last byte of packet */ - pad_len = *(p_start + p_data->p_pkt->len); + pad_len = *(p_start + len - 1); } /* do sanity check */ - if ((offset > p_data->p_pkt->len) || - ((pad_len + offset) > p_data->p_pkt->len)) { + if (pad_len >= (len - offset)) { AVDT_TRACE_WARNING("Got bad media packet"); osi_free_and_reset((void**)&p_data->p_pkt); } |