tree 72cc370c0caa07836c5d8c1111a0a84b39724f0f
parent fd44afa4fe679e1cb3858c062bd665974f4023c2
author Hui Peng <phui@google.com> 1682791477 +0000
committer Hui Peng <phui@google.com> 1698078485 +0000

Fix an OOB bug in btif_to_bta_response and attp_build_value_cmd

1. The size of `p_src->attr_value.value` is dependent on
   `p_src->attr_value.len`. While copying `p_src->attr_value.value`,
   to `p_dest->attr_value.value`, it always copies GATT_MAX_ATTR_LEN
   bytes, it may result in OOB read in `p_src->attr_value.value`;

2. As the `p_dest->attr_value.len` does not map the length of
   `p_dest->attr_value.value`, it may result in OOB read in
   attp_build_value_cmd;

Bug: 276898739
Test: m com.android.btservices
Tag: #security
Ignore-AOSP-First: security
Change-Id: Iefa66f3a293ac2072ba79853a9ec23cdfe4c1368