diff options
| author | Android Build Merger (Role) <noreply-android-build-merger@google.com> | 2018-06-05 03:48:20 +0000 |
|---|---|---|
| committer | Android Build Merger (Role) <noreply-android-build-merger@google.com> | 2018-06-05 03:48:20 +0000 |
| commit | e7c88913192cdd80d64f62b6f146ca0c52c78dd8 (patch) | |
| tree | d5b5017f20c5572705d04d997eb33d9a7a7e30e7 | |
| parent | 6245466d55c4abb8047b4c167fced0804a9f217e (diff) | |
| parent | 862eb4827b1b6de73655b152b3bc17bd7d5600c8 (diff) | |
| download | bt-e7c88913192cdd80d64f62b6f146ca0c52c78dd8.tar.gz | |
[automerger] Add checks whether the AVDTP element data length is valid am: e192c988cb am: 6b2f63f880 am: ac8793939a am: 862eb4827b
Change-Id: I336035e480bcd33d67b90543a9f81fe919dc649a
| -rw-r--r-- | stack/avdt/avdt_msg.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/stack/avdt/avdt_msg.c b/stack/avdt/avdt_msg.c index adc1ae731..9697a590b 100644 --- a/stack/avdt/avdt_msg.c +++ b/stack/avdt/avdt_msg.c @@ -26,6 +26,7 @@ * ******************************************************************************/ +#include <log/log.h> #include <string.h> #include "bt_types.h" #include "bt_target.h" @@ -673,6 +674,11 @@ static UINT8 avdt_msg_prs_cfg(tAVDT_CFG *p_cfg, UINT8 *p, UINT16 len, UINT8* p_e case AVDT_CAT_PROTECT: p_cfg->psc_mask &= ~AVDT_PSC_PROTECT; + if (p + elem_len > p_end) { + err = AVDT_ERR_LENGTH; + android_errorWriteLog(0x534e4554, "78288378"); + break; + } if ((elem_len + protect_offset) < AVDT_PROTECT_SIZE) { p_cfg->num_protect++; @@ -747,6 +753,11 @@ static UINT8 avdt_msg_prs_cfg(tAVDT_CFG *p_cfg, UINT8 *p, UINT16 len, UINT8* p_e { tmp = AVDT_CODEC_SIZE - 1; } + if (p + tmp > p_end) { + err = AVDT_ERR_LENGTH; + android_errorWriteLog(0x534e4554, "78288378"); + break; + } p_cfg->num_codec++; p_cfg->codec_info[0] = elem_len; memcpy(&p_cfg->codec_info[1], p, tmp); |