mirror of
https://github.com/Divested-Mobile/DivestOS-Build.git
synced 2024-10-01 01:35:54 -04:00
082bc48c32
https://review.lineageos.org/q/topic:P_asb_2022-05 https://review.lineageos.org/q/topic:P_asb_2022-06 https://review.lineageos.org/q/topic:P_asb_2022-07 https://review.lineageos.org/q/topic:P_asb_2022-08 https://review.lineageos.org/q/topic:P_asb_2022-09 https://review.lineageos.org/q/topic:P_asb_2022-10 https://review.lineageos.org/q/topic:P_asb_2022-11 https://review.lineageos.org/q/topic:P_asb_2022-12 https://review.lineageos.org/q/topic:P_asb_2023-01 https://review.lineageos.org/q/topic:P_asb_2023-02 https://review.lineageos.org/q/topic:P_asb_2023-03 https://review.lineageos.org/q/topic:P_asb_2023-04 https://review.lineageos.org/q/topic:P_asb_2023-05 https://review.lineageos.org/q/topic:P_asb_2023-06 https://review.lineageos.org/q/topic:P_asb_2023-07 accounted for via manifest change: https://review.lineageos.org/c/LineageOS/android_external_freetype/+/361250 https://review.lineageos.org/q/topic:P_asb_2023-08 accounted for via manifest change: https://review.lineageos.org/c/LineageOS/android_external_freetype/+/364606 accounted for via patches: https://review.lineageos.org/c/LineageOS/android_system_ca-certificates/+/365328 https://review.lineageos.org/q/topic:P_asb_2023-09 https://review.lineageos.org/q/topic:P_asb_2023-10 https://review.lineageos.org/q/topic:P_asb_2023-11 accounted for via patches: https://review.lineageos.org/c/LineageOS/android_system_ca-certificates/+/374916 https://review.lineageos.org/q/topic:P_asb_2023-12 https://review.lineageos.org/q/topic:P_asb_2024-01 https://review.lineageos.org/q/topic:P_asb_2024-02 https://review.lineageos.org/q/topic:P_asb_2024-03 https://review.lineageos.org/q/topic:P_asb_2024-04 Signed-off-by: Tavi <tavi@divested.dev>
35 lines
1.1 KiB
Diff
35 lines
1.1 KiB
Diff
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
From: Hui Peng <phui@google.com>
|
|
Date: Fri, 20 Jan 2023 19:39:30 +0000
|
|
Subject: [PATCH] Fix an OOB bug in register_notification_rsp
|
|
|
|
This is a backport of I901d973a736678d7f3cc816ddf0cbbcbbd1fe93f
|
|
to rvc-dev.
|
|
|
|
Bug: 245916076
|
|
Test: manual
|
|
Ignore-AOSP-First: security
|
|
Change-Id: I37a9f45e707702b2ec52b5a2d572f177f2911765
|
|
(cherry picked from commit 901e34203c6280d414cbfa3978de04fd6515ffdf)
|
|
Merged-In: I37a9f45e707702b2ec52b5a2d572f177f2911765
|
|
---
|
|
btif/src/btif_rc.cc | 5 +++++
|
|
1 file changed, 5 insertions(+)
|
|
|
|
diff --git a/btif/src/btif_rc.cc b/btif/src/btif_rc.cc
|
|
index c226b5f21..9bc30599c 100644
|
|
--- a/btif/src/btif_rc.cc
|
|
+++ b/btif/src/btif_rc.cc
|
|
@@ -1889,6 +1889,11 @@ static bt_status_t register_notification_rsp(
|
|
dump_rc_notification_event_id(event_id));
|
|
std::unique_lock<std::mutex> lock(btif_rc_cb.lock);
|
|
|
|
+ if (event_id > MAX_RC_NOTIFICATIONS) {
|
|
+ BTIF_TRACE_ERROR("Invalid event id");
|
|
+ return BT_STATUS_PARM_INVALID;
|
|
+ }
|
|
+
|
|
memset(&(avrc_rsp.reg_notif), 0, sizeof(tAVRC_REG_NOTIF_RSP));
|
|
|
|
avrc_rsp.reg_notif.event_id = event_id;
|