DivestOS/Patches/LineageOS-14.1/android_system_bt/341070.patch

From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Ted Wang <tedwang@google.com>
Date: Fri, 1 Apr 2022 11:22:34 +0800
Subject: [PATCH] Fix potential interger overflow when parsing vendor response

Add check for str_len to prevent potential OOB read in vendor response.

Bug: 205570663
Tag: #security
Test: net_test_stack:StackAvrcpTest
Ignore-AOSP-First: Security
Change-Id: Iea2c3e17c2c8cc56468c4456822e1c4c5c15f5bc
Merged-In: Iea2c3e17c2c8cc56468c4456822e1c4c5c15f5bc
(cherry picked from commit 96ef1fc9cbe38f1224b4e4a2dca3ecfb44a6aece)
Merged-In: Iea2c3e17c2c8cc56468c4456822e1c4c5c15f5bc
[basilgello: Backport to LineageOS 14.1: only AVRC_PDU_GET_ELEMENT_ATTR
 is present in the affected logic]
Signed-off-by: Vasyl Gello <vasek.gello@gmail.com>
---
 stack/avrc/avrc_pars_ct.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/stack/avrc/avrc_pars_ct.c b/stack/avrc/avrc_pars_ct.c
index 077ef1210..fc94424ba 100644
--- a/stack/avrc/avrc_pars_ct.c
+++ b/stack/avrc/avrc_pars_ct.c
@@ -541,8 +541,12 @@ static tAVRC_STS avrc_ctrl_pars_vendor_rsp(
                 BE_STREAM_TO_UINT32(p_attrs[i].attr_id, p);
                 BE_STREAM_TO_UINT16(p_attrs[i].name.charset_id, p);
                 BE_STREAM_TO_UINT16(p_attrs[i].name.str_len, p);
-                min_len += p_attrs[i].name.str_len;
-                if (len < min_len)
+                if ((UINT16)(min_len + p_attrs[i].name.str_len) <
+                    min_len) {
+                   // Check for overflow
+                   android_errorWriteLog(0x534e4554, "205570663");
+                }
+                if (len - min_len < p_attrs[i].name.str_len)
                 {
                    for (int j = 0; j < i; j++)
                    {
@@ -552,6 +556,7 @@ static tAVRC_STS avrc_ctrl_pars_vendor_rsp(
                    p_result->get_attrs.num_attrs = 0;
                    goto length_error;
                 }
+                min_len += p_attrs[i].name.str_len;
                 if (p_attrs[i].name.str_len > 0)
                 {
                     p_attrs[i].name.p_str = (UINT8 *)osi_calloc(p_attrs[i].name.str_len);