mirror of
https://github.com/Divested-Mobile/DivestOS-Build.git
synced 2024-10-01 01:35:54 -04:00
45 lines
1.6 KiB
Diff
45 lines
1.6 KiB
Diff
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
From: Brian Delwiche <delwiche@google.com>
|
|
Date: Thu, 25 Aug 2022 18:52:28 +0000
|
|
Subject: [PATCH] RESTRICT AUTOMERGE Added max buffer length check
|
|
|
|
Bug: 230867224
|
|
Test: Manual -- paired Bluetooth headset and played audio
|
|
Tags: #security
|
|
Ignore-AOSP-First: Security
|
|
Change-Id: I740038288143715a1c06db781efd674b269a7f3e
|
|
(cherry picked from commit 769f55450bd2eb94ddb9080f730e404de7716bda)
|
|
Merged-In: I740038288143715a1c06db781efd674b269a7f3e
|
|
---
|
|
stack/avct/avct_lcb_act.c | 9 ++++++++-
|
|
1 file changed, 8 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/stack/avct/avct_lcb_act.c b/stack/avct/avct_lcb_act.c
|
|
index 878dd82b7..173c3070e 100644
|
|
--- a/stack/avct/avct_lcb_act.c
|
|
+++ b/stack/avct/avct_lcb_act.c
|
|
@@ -30,6 +30,7 @@
|
|
#include "avct_int.h"
|
|
#include "bt_common.h"
|
|
#include "btm_api.h"
|
|
+#include "osi/include/log.h"
|
|
|
|
/* packet header length lookup table */
|
|
const UINT8 avct_lcb_pkt_type_len[] = {
|
|
@@ -61,8 +62,14 @@ static BT_HDR *avct_lcb_msg_asmbl(tAVCT_LCB *p_lcb, BT_HDR *p_buf)
|
|
AVCT_PRS_PKT_TYPE(p, pkt_type);
|
|
|
|
/* quick sanity check on length */
|
|
- if (p_buf->len < avct_lcb_pkt_type_len[pkt_type])
|
|
+ if (p_buf->len < avct_lcb_pkt_type_len[pkt_type] ||
|
|
+ (sizeof(BT_HDR) + p_buf->offset + p_buf->len) > BT_DEFAULT_BUFFER_SIZE)
|
|
{
|
|
+ if ((sizeof(BT_HDR) + p_buf->offset + p_buf->len) >
|
|
+ BT_DEFAULT_BUFFER_SIZE)
|
|
+ {
|
|
+ android_errorWriteWithInfoLog(0x534e4554, "230867224", -1, NULL, 0);
|
|
+ }
|
|
osi_free(p_buf);
|
|
AVCT_TRACE_WARNING("Bad length during reassembly");
|
|
p_ret = NULL;
|