Skip to content
Snippets Groups Projects
Commit 33334f0d authored by Hui Peng's avatar Hui Peng
Browse files

Add validation on sdp attributes in bta_ag_sdp.cc

Bug: 263958603
Test: atest bt_host_test_bta
Ignore-AOSP-First: security
Tag: #security
Change-Id: I51c0215125808102b6cff880357d19012ffc37b9
Merged-In: I51c0215125808102b6cff880357d19012ffc37b9
(cherry picked from commit 509feb84)
parent b7c4b272
No related branches found
No related tags found
No related merge requests found
......@@ -358,7 +358,9 @@ bool bta_ag_sdp_find_attr(tBTA_AG_SCB* p_scb, tBTA_SERVICE_MASK service) {
}
/* get features if HFP */
p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_SUPPORTED_FEATURES);
if (p_attr != nullptr) {
if (p_attr != nullptr &&
SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&
SDP_DISC_ATTR_LEN(p_attr->attr_len_type) >= 2) {
/* Found attribute. Get value. */
/* There might be race condition between SDP and BRSF. */
/* Do not update if we already received BRSF. */
......@@ -395,7 +397,9 @@ bool bta_ag_sdp_find_attr(tBTA_AG_SCB* p_scb, tBTA_SERVICE_MASK service) {
/* get features if HSP */
p_attr =
SDP_FindAttributeInRec(p_rec, ATTR_ID_REMOTE_AUDIO_VOLUME_CONTROL);
if (p_attr != nullptr) {
if (p_attr != nullptr &&
SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == BOOLEAN_DESC_TYPE &&
SDP_DISC_ATTR_LEN(p_attr->attr_len_type) >= 1) {
/* Remote volume control of HSP */
if (p_attr->attr_value.v.u8)
p_scb->peer_features |= BTA_AG_PEER_FEAT_VOL;
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment