diff options
| author | Brian Delwiche <delwiche@google.com> | 2024-10-11 21:06:29 +0000 |
|---|---|---|
| committer | aoleary <seanm187@gmail.com> | 2025-07-08 20:45:38 +0000 |
| commit | 5bc4103138ef6da65a02b5e8d1737904e5f4d212 (patch) | |
| tree | 605584e6a181e95b774d7034e24e336286e62367 /tools/rootcanal/scripts/send_simple_commands.py | |
| parent | 40270cb35dd73be66616f00359d7b389134ae6fe (diff) | |
Fix type confusion in avdt_msg.cc
It is possible for a malicious user to reply to a pending AVDT message
with the wrong type, leading to type confusion and an eventual OOB
access.
Add message type validation.
Bug: 273995284
Test: m libbluetooth
Ignore-AOSP-First: security
Tag: #security
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:12d26748f31d855ac18de9df1832f60a4bd73265)
Merged-In: I87a0df92710658d6c27d9b63ee7813a0d45a301a
Change-Id: I87a0df92710658d6c27d9b63ee7813a0d45a301a
Diffstat (limited to 'tools/rootcanal/scripts/send_simple_commands.py')
0 files changed, 0 insertions, 0 deletions