diff options
| author | Hui Peng <phui@google.com> | 2023-11-29 18:23:53 +0000 |
|---|---|---|
| committer | Android Build Coastguard Worker <android-build-coastguard-worker@google.com> | 2023-12-11 21:39:12 +0000 |
| commit | 9bde3685e03e9e88a0b6de8bf2299dbe023a0e3f (patch) | |
| tree | 5e39551d4ff11af40977f7c237d9cd5beedd8b44 | |
| parent | 67003c1e1b251ee965be1b4fa31141f1abcd0fee (diff) | |
| download | bt-9bde3685e03e9e88a0b6de8bf2299dbe023a0e3f.tar.gz | |
Fix an OOB write bug in attp_build_read_by_type_value_cmd
This is a backport of I2a95bbcce9a16ac84dd714eb4561428711a9872e
Bug: 297524203
Test: m com.android.btservices
Ignore-AOSP-First: security
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:9cdac321797cbe8214bc3f6294ca9a71a4be07a7)
Merged-In: I8c5daedb1605307df697ea5d875153dfcf3f5181
Change-Id: I8c5daedb1605307df697ea5d875153dfcf3f5181
| -rw-r--r-- | stack/gatt/att_protocol.cc | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/stack/gatt/att_protocol.cc b/stack/gatt/att_protocol.cc index 87da319d8..e7d22c508 100644 --- a/stack/gatt/att_protocol.cc +++ b/stack/gatt/att_protocol.cc @@ -159,8 +159,14 @@ static BT_HDR* attp_build_read_by_type_value_cmd( uint16_t payload_size, tGATT_FIND_TYPE_VALUE* p_value_type) { uint8_t* p; uint16_t len = p_value_type->value_len; - BT_HDR* p_buf = - (BT_HDR*)osi_malloc(sizeof(BT_HDR) + payload_size + L2CAP_MIN_OFFSET); + BT_HDR* p_buf = nullptr; + + if (payload_size < 5) { + return nullptr; + } + + p_buf = + (BT_HDR*)osi_malloc(sizeof(BT_HDR) + payload_size + L2CAP_MIN_OFFSET); p = (uint8_t*)(p_buf + 1) + L2CAP_MIN_OFFSET; p_buf->offset = L2CAP_MIN_OFFSET; |