mirror of
https://github.com/Divested-Mobile/DivestOS-Build.git
synced 2024-10-01 01:35:54 -04:00
50 lines
2.1 KiB
Diff
50 lines
2.1 KiB
Diff
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
From: Ted Wang <tedwang@google.com>
|
|
Date: Fri, 1 Apr 2022 11:22:34 +0800
|
|
Subject: [PATCH] Fix potential interger overflow when parsing vendor response
|
|
|
|
Add check for str_len to prevent potential OOB read in vendor response.
|
|
|
|
Bug: 205570663
|
|
Tag: #security
|
|
Test: net_test_stack:StackAvrcpTest
|
|
Ignore-AOSP-First: Security
|
|
Change-Id: Iea2c3e17c2c8cc56468c4456822e1c4c5c15f5bc
|
|
Merged-In: Iea2c3e17c2c8cc56468c4456822e1c4c5c15f5bc
|
|
(cherry picked from commit 96ef1fc9cbe38f1224b4e4a2dca3ecfb44a6aece)
|
|
Merged-In: Iea2c3e17c2c8cc56468c4456822e1c4c5c15f5bc
|
|
[basilgello: Backport to LineageOS 14.1: only AVRC_PDU_GET_ELEMENT_ATTR
|
|
is present in the affected logic]
|
|
Signed-off-by: Vasyl Gello <vasek.gello@gmail.com>
|
|
---
|
|
stack/avrc/avrc_pars_ct.c | 9 +++++++--
|
|
1 file changed, 7 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/stack/avrc/avrc_pars_ct.c b/stack/avrc/avrc_pars_ct.c
|
|
index 077ef1210..fc94424ba 100644
|
|
--- a/stack/avrc/avrc_pars_ct.c
|
|
+++ b/stack/avrc/avrc_pars_ct.c
|
|
@@ -541,8 +541,12 @@ static tAVRC_STS avrc_ctrl_pars_vendor_rsp(
|
|
BE_STREAM_TO_UINT32(p_attrs[i].attr_id, p);
|
|
BE_STREAM_TO_UINT16(p_attrs[i].name.charset_id, p);
|
|
BE_STREAM_TO_UINT16(p_attrs[i].name.str_len, p);
|
|
- min_len += p_attrs[i].name.str_len;
|
|
- if (len < min_len)
|
|
+ if ((UINT16)(min_len + p_attrs[i].name.str_len) <
|
|
+ min_len) {
|
|
+ // Check for overflow
|
|
+ android_errorWriteLog(0x534e4554, "205570663");
|
|
+ }
|
|
+ if (len - min_len < p_attrs[i].name.str_len)
|
|
{
|
|
for (int j = 0; j < i; j++)
|
|
{
|
|
@@ -552,6 +556,7 @@ static tAVRC_STS avrc_ctrl_pars_vendor_rsp(
|
|
p_result->get_attrs.num_attrs = 0;
|
|
goto length_error;
|
|
}
|
|
+ min_len += p_attrs[i].name.str_len;
|
|
if (p_attrs[i].name.str_len > 0)
|
|
{
|
|
p_attrs[i].name.p_str = (UINT8 *)osi_calloc(p_attrs[i].name.str_len);
|