| commit | 15500502b794953e025f7543b3bb1b0ed5aecf87 | [log] [tgz] |
|---|---|---|
| author | Dennis Jeon <dennis.jeon@broadcom.corp-partner.google.com> | Thu Dec 15 21:02:11 2022 +0900 |
| committer | chenpaul <chenpaul@google.com> | Thu Dec 29 09:17:18 2022 +0800 |
| tree | 3768bfb78d7d003564550cfdfe8667ca307197d9 | |
| parent | dd6084ba8f5ce59234d107182e75267c53c91a30 [diff] |
Fix OOB write possible when len equals sizeof array service_specific_info_len sets as serviceSpecificInfo.size() In case of the len equals sizeof(service_specific_info), OOB write possible. Bug: 261857623 Test: tested with poc program Signed-off-by: Dennis Jeon <dennis.jeon@broadcom.corp-partner.google.com> Change-Id: Ifdaaf475555fd4c9836758d2e804fcee4f822a89