Merge "Add length check when copy AVDTP packet" into tm-dev am: 851a2d15

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/19500904



Change-Id: Icd1caf9434b3b1e2fc2b09f471c897e76ace4578
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

system/stack/avdt/avdt_msg.cc

@@ -1252,6 +1252,10 @@ BT_HDR* avdt_msg_asmbl(AvdtpCcb* p_ccb, BT_HDR* p_buf) {
      * would have allocated smaller buffer.
      */
     p_ccb->p_rx_msg = (BT_HDR*)osi_malloc(BT_DEFAULT_BUFFER_SIZE);
+    if (sizeof(BT_HDR) + p_buf->offset + p_buf->len > BT_DEFAULT_BUFFER_SIZE) {
+      android_errorWriteLog(0x534e4554, "232023771");
+      return NULL;
+    }
     memcpy(p_ccb->p_rx_msg, p_buf, sizeof(BT_HDR) + p_buf->offset + p_buf->len);
 
     /* Free original buffer */