diff options
| author | Brian Delwiche <delwiche@google.com> | 2024-04-05 00:41:49 +0000 |
|---|---|---|
| committer | aoleary <seanm187@gmail.com> | 2025-07-09 07:12:44 +0000 |
| commit | c251f67ec67d0dda4f8203a8bbaa3ba3c973e391 (patch) | |
| tree | d392019cb4b50ed472556f5312a016b48487e323 /system/stack/test/common/stack_test_packet_utils.h | |
| parent | e86a12a29106ac2c69dee480638565638994dde2 (diff) | |
Fix OOB read in bta_av_setconfig_rej
The bta_av_config_ind function in bta_av_aact.cc makes a call in some
user journeys to bta_av_setconfig_rej, constructing its p_data argument
(a union datatype) as a tBTA_AV_CI_SETCONFIG. This is a valid member of
the union, but bta_av_setconfig_rej makes the assumption that the
variable being passed has been set up as a tBTA_AV_STR_MSG, which is not
true in this case. This causes OOB access.
Draw the required data instead from the stream control block, which
should not be subject to this confusion.
Bug: 260230151
Test: m libbluetooth
Test: manual
Ignore-AOSP-First: security
Tag: #security
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:1816d40959e366f5feaa50a8db673141022634e9)
Merged-In: If7fee75ff454ab925b9661c78980b7c093c29f0b
Change-Id: If7fee75ff454ab925b9661c78980b7c093c29f0b
Diffstat (limited to 'system/stack/test/common/stack_test_packet_utils.h')
0 files changed, 0 insertions, 0 deletions