From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Brian Delwiche Date: Thu, 25 Aug 2022 18:52:28 +0000 Subject: [PATCH] RESTRICT AUTOMERGE Added max buffer length check Bug: 230867224 Test: Manual -- paired Bluetooth headset and played audio Tags: #security Ignore-AOSP-First: Security Change-Id: I740038288143715a1c06db781efd674b269a7f3e (cherry picked from commit 769f55450bd2eb94ddb9080f730e404de7716bda) Merged-In: I740038288143715a1c06db781efd674b269a7f3e --- stack/avct/avct_lcb_act.cc | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/stack/avct/avct_lcb_act.cc b/stack/avct/avct_lcb_act.cc index faa098b80..81ae79d63 100644 --- a/stack/avct/avct_lcb_act.cc +++ b/stack/avct/avct_lcb_act.cc @@ -30,6 +30,7 @@ #include "bt_types.h" #include "bt_utils.h" #include "btm_api.h" +#include "osi/include/log.h" #include "osi/include/osi.h" /* packet header length lookup table */ @@ -58,7 +59,12 @@ static BT_HDR* avct_lcb_msg_asmbl(tAVCT_LCB* p_lcb, BT_HDR* p_buf) { pkt_type = AVCT_PKT_TYPE(p); /* quick sanity check on length */ - if (p_buf->len < avct_lcb_pkt_type_len[pkt_type]) { + if (p_buf->len < avct_lcb_pkt_type_len[pkt_type] || + (sizeof(BT_HDR) + p_buf->offset + p_buf->len) > BT_DEFAULT_BUFFER_SIZE) { + if ((sizeof(BT_HDR) + p_buf->offset + p_buf->len) > + BT_DEFAULT_BUFFER_SIZE) { + android_errorWriteWithInfoLog(0x534e4554, "230867224", -1, NULL, 0); + } osi_free(p_buf); AVCT_TRACE_WARNING("Bad length during reassembly"); p_ret = NULL;