Skip to content
Snippets Groups Projects
Commit 14621c25 authored by Hui Peng's avatar Hui Peng Committed by Android (Google) Code Review
Browse files

Merge "Fix an OOB Write bug in avrc_vendor_msg" into tm-dev

parents 82ce3fef d5de235b
No related branches found
No related tags found
No related merge requests found
......@@ -49,9 +49,20 @@ static BT_HDR* avrc_vendor_msg(tAVRC_MSG_VENDOR* p_msg) {
BT_HDR* p_cmd;
uint8_t* p_data;
CHECK(p_msg != NULL);
/*
An AVRC cmd consists of at least of:
- A BT_HDR, plus
- AVCT_MSG_OFFSET, plus
- 3 bytes for ctype, subunit_type and op_vendor, plus
- 3 bytes for company_id
*/
#define AVRC_MIN_VENDOR_CMD_LEN (sizeof(BT_HDR) + AVCT_MSG_OFFSET + 3 + 3)
if (p_msg == nullptr ||
AVRC_META_CMD_BUF_SIZE < AVRC_MIN_VENDOR_CMD_LEN + p_msg->vendor_len) {
return nullptr;
}
CHECK(AVRC_META_CMD_BUF_SIZE > (AVRC_MIN_CMD_LEN + p_msg->vendor_len));
p_cmd = (BT_HDR*)osi_calloc(AVRC_META_CMD_BUF_SIZE);
p_cmd->offset = AVCT_MSG_OFFSET;
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment