gatt_cl.cc accesses a header field after the buffer holding it may have
been freed.

Track the relevant state as a local variable instead.

Bug: 274617156
Test: atest: bluetooth, validated against fuzzer
Tag: #security
Ignore-AOSP-First: Security
Change-Id: I085ecfa1a9ba098ecbfecbd3cb3e263ae13f9724

If the length of the packet is less than 4 or the offset is 0
OOB access is triggered.

Bug: 259939364
Test: manual
Ignore-AOSP-First: security
Merged-In: I11a3ebf20c45e9e69a4008a7d7271470e6235fe1
Change-Id: I11a3ebf20c45e9e69a4008a7d7271470e6235fe1

Bug: 260568750
Test: manual
Tag: #security
Ignore-AOSP-First: security
Merged-In: I58b259541a507d65271c4e8b61fcd878a3f90ec0
Change-Id: I58b259541a507d65271c4e8b61fcd878a3f90ec0

Bug: 260568359
Test: manual
Tag: #security
Ignore-AOSP-First: security
Merged-In: Icb13312b79a59117c9524ddad4163135b364baba
Change-Id: Icb13312b79a59117c9524ddad4163135b364baba

Bug: 254445952
Test: manual
Tag: #security
Ignore-AOSP-First: security
Merged-In: I25f928cc9fa4b3338b1885412e5f894b4155da71
Change-Id: I25f928cc9fa4b3338b1885412e5f894b4155da71

Bug: 260568354
Test: manual
Tag: #security
Ignore-AOSP-First: security
Merged-In: I739a42519df656b28d6043f179d02316bf5a71f2
Change-Id: I739a42519df656b28d6043f179d02316bf5a71f2

Bug: 260568083
Test: manual
Tag: #security
Ignore-AOSP-First: security
Merged-In: I47f4806743b5837f4d7de774eafc95824b0abdd6
Change-Id: I47f4806743b5837f4d7de774eafc95824b0abdd6

Bug: 256165737
Test: manual
Tag: #security
Ignore-AOSP-First: security
Merged-In: I0a626bbc1a72c8bc9740d139b54726b188b6f1df
Change-Id: I0a626bbc1a72c8bc9740d139b54726b188b6f1df

Bug: 245915315
Test: manual
Tag: #security
Ignore-AOSP-First: security
Merged-In: I4b08db42bed52bb250098a7744b689a5d0c105b2
Change-Id: I4b08db42bed52bb250098a7744b689a5d0c105b2

Bug: 260568367
Test: manual
Ignore-AOSP-First: security
Merged-In: I0f35513b9655acaa6fe07d2ba2063c1f11d6465b
Change-Id: I0f35513b9655acaa6fe07d2ba2063c1f11d6465b

Bug: 260569414
Test: manual
Ignore-AOSP-First: security
Merged-In: I7b6e6db6598d82a0191f64cab713a6482b69954b
Change-Id: I7b6e6db6598d82a0191f64cab713a6482b69954b

Bug: 260230274
Test: manual
Tag: #security
Ignore-AOSP-First: security
Merged-In: Id733a472236c005e30ff5c2b56b51d6e10fc9061
Change-Id: Id733a472236c005e30ff5c2b56b51d6e10fc9061

Bug: 260568245
Test: manual
Tag: #security
Ignore-AOSP-First: security
Merged-In: I6cddf5189dbc34ce8346167ec04cb50c936898cf
Change-Id: I6cddf5189dbc34ce8346167ec04cb50c936898cf

Bug: 260569449
Test: manual
Tag: #security
Ignore-AOSP-First: security
Merged-In: I096fb985f025908f9d68d2735b9f98515b04cfb9
Change-Id: I096fb985f025908f9d68d2735b9f98515b04cfb9

Bug: 255304475
Test: atest net_test_stack_btm
Ignore-AOSP-First: security
Tag: #security
Merged-In: I3d1523b6dbadf75f682663504a0c932624c33d08
Change-Id: I3d1523b6dbadf75f682663504a0c932624c33d08

Regression test: I3d1523b6dbadf75f682663504a0c932624c33d08

Bug: 255304475
Test: atest net_test_stack_btm
Tag: #security
Ignore-AOSP-First: security
Merged-In: I3a8158a5db7e59acdaaa47e2327f6bdf492e47e7
Change-Id: I3a8158a5db7e59acdaaa47e2327f6bdf492e47e7

Bug: 260078907
Test: atest net_test_stack_btm
Ignore-AOSP-First: security
Tag: #security
Merged-In: Ie8c6cb188cf7cde94d2f7dc0db04b3de51e08678
Change-Id: Ie8c6cb188cf7cde94d2f7dc0db04b3de51e08678

Regression test: Ie8c6cb188cf7cde94d2f7dc0db04b3de51e08678

Bug: 260078907
Test: atest net_test_stack_btm
Tag: #security
Ignore-AOSP-First: security
Merged-In: I4aec266e09e33e8a19a9e33715fdb7ed7f4d4f58
Change-Id: I4aec266e09e33e8a19a9e33715fdb7ed7f4d4f58

The size of the packet is not checked when
`vendor_cap_supported_version >= kBqrIsoVersion` holds.
This patch adds a check on the size in this code path.

Bug: 242993878
Test: manual
Tag: #security
Ignore-AOSP-First: security
Merged-In: I3191701c54b342ef3cf2296de075666b13e3096e
Change-Id: I3191701c54b342ef3cf2296de075666b13e3096e

Bug: 259675705
Test: manual
Tag: #security
Ignore-AOSP-First: security
Merged-In: I13be3103903631de4a0fa2080151bc89884c65c9
Change-Id: I13be3103903631de4a0fa2080151bc89884c65c9

There is a use-after-free bug in AttributionProcessor::OnWakelockReleased
resulted from a well-known misuse of using iterators to delete
items in containers (the deleted items are used for calculating the next iterator
in the next round). This patch fix it with correct usage.

see the regression test is in I1709af943b6fa238dd4df41a62e6add36984c9ec

Bug: 254774758
Ignore-AOSP-First: security
Test: atest bluetooth_test_gd_unit
Merged-In: If9f14d5fe2fbf2150f2ab0d1f90ce0f263399227
Change-Id: If9f14d5fe2fbf2150f2ab0d1f90ce0f263399227

When the `attr_pad` becomes full, it is possible
that un index of `-1` is computed write
a zero byte to `p_val`, rusulting OOB write.

```
  p_val[SDP_MAX_PAD_LEN - p_rec->free_pad_ptr - 1] = '\0';
```

Bug: 261867748
Test: manual
Tag: #security
Ignore-AOSP-First: security
Merged-In: I937d22a2df26fca1d7f06b10182c4e713ddfed1b
Change-Id: I937d22a2df26fca1d7f06b10182c4e713ddfed1b

In  A2DP_BuildCodecHeaderSbc when p_buf->offset is 0, the
`-=` operation on it may result in integer underflow and
OOB write with the computed pointer passed to
A2DP_BuildMediaPayloadHeaderSbc.

The regression test is I2e026025ce49a02280dfcacd08f4bfc1b5d12264

Bug: 186803518
Test: atest net_test_stack_a2dp_codecs_native
Ignore-AOSP-First: security
Merged-In: I45320085b1e458d3b0e0d86162a35aaaae7b34cb
Change-Id: I45320085b1e458d3b0e0d86162a35aaaae7b34cb

Bug: 258652631
Test: manual
Ignore-AOSP-First: security
Merged-In: Ifffa2c7f679c4ef72dbdb6b1f3378ca506680084
Change-Id: Ifffa2c7f679c4ef72dbdb6b1f3378ca506680084

Bug: 255305114
Test: manual
Tag: #security
Ignore-AOSP-First: security
Change-Id: I7b7f071017a6c04f6bee901f7151e4f5df0a0c64
(cherry picked from commit 6d0884df)
Merged-In: I7b7f071017a6c04f6bee901f7151e4f5df0a0c64