Skip to content
Snippets Groups Projects
Commit a2ccb20f authored by Hui Peng's avatar Hui Peng
Browse files

Add type validation in bta_hf_client_sdp.cc

Bug: 263958603
Test: atest net_test_bta
Ignore-AOSP-First: security
Tag: #security

Merged-In: I70a15be0409d9368e1d5984b1719f9a917c8cb7e
Change-Id: I70a15be0409d9368e1d5984b1719f9a917c8cb7e
(cherry picked from commit 3bd9e5b1)
parent b7c4b272
No related branches found
No related tags found
No related merge requests found
......@@ -251,7 +251,9 @@ bool bta_hf_client_sdp_find_attr(tBTA_HF_CLIENT_CB* client_cb) {
/* get features */
p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_SUPPORTED_FEATURES);
if (p_attr != NULL) {
if (p_attr != NULL &&
SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&
SDP_DISC_ATTR_LEN(p_attr->attr_len_type) >= 2) {
/* Found attribute. Get value. */
/* There might be race condition between SDP and BRSF. */
/* Do not update if we already received BRSF. */
......@@ -266,7 +268,9 @@ bool bta_hf_client_sdp_find_attr(tBTA_HF_CLIENT_CB* client_cb) {
/* get network for ability to reject calls */
p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_NETWORK);
if (p_attr != NULL) {
if (p_attr != NULL &&
SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&
SDP_DISC_ATTR_LEN(p_attr->attr_len_type) >= 2) {
if (p_attr->attr_value.v.u16 == 0x01) {
client_cb->peer_features |= BTA_HF_CLIENT_PEER_REJECT;
}
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment