commit 243fdf1c0d53bda9e829b4bec9f7c2a824b4d3d1
author Brian Delwiche <delwiche@google.com> Fri May 19 21:46:53 2023 +0000
committer Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Wed Oct 11 22:50:43 2023 +0000
tree 392745e9485d10ea099e62738d1888d5d6934ef4
parent a218e5be5e4049eae3b321f2a535a128d65d00b6

Add bounds checks in btif_avrcp_audio_track.cc

Fuzz testing reveals that the transcodeQ*ToFloat family of functions are
not bounds checked, causing a potential OOB write.

Check these functions against bounds of the destination array.

Bug: 275895309
Test: atest bluetooth_test_gd_unit, net_test_stack_btm
Tag: #security
Ignore-AOSP-First: Security
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:46803ae95d63ee133eae83d885e7c051964dc8ed)
Merged-In: I7a13261429797769cf5b913912a30e249668ac93
Change-Id: I7a13261429797769cf5b913912a30e249668ac93

system/btif/src/btif_avrcp_audio_track.cc

diff --git a/system/btif/src/btif_avrcp_audio_track.cc b/system/btif/src/btif_avrcp_audio_track.cc
index 8ca5c97..e17f80f 100644
--- a/system/btif/src/btif_avrcp_audio_track.cc
+++ b/system/btif/src/btif_avrcp_audio_track.cc
@@ -23,6 +23,8 @@
 #include <base/logging.h>
 #include <utils/StrongPointer.h>
 
+#include <algorithm>
+
 #include "bt_target.h"
 #include "osi/include/log.h"
 
@@ -152,7 +154,7 @@
                                   BtifAvrcpAudioTrack* trackHolder) {
   size_t sampleSize = sampleSizeFor(trackHolder);
   size_t i = 0;
-  for (; i <= length / sampleSize; i++) {
+  for (; i < std::min(trackHolder->bufferLength, length / sampleSize); i++) {
     trackHolder->buffer[i] = ((int16_t*)buffer)[i] * kScaleQ15ToFloat;
   }
   return i * sampleSize;
@@ -162,7 +164,7 @@
                                   BtifAvrcpAudioTrack* trackHolder) {
   size_t sampleSize = sampleSizeFor(trackHolder);
   size_t i = 0;
-  for (; i <= length / sampleSize; i++) {
+  for (; i < std::min(trackHolder->bufferLength, length / sampleSize); i++) {
     size_t offset = i * sampleSize;
     int32_t sample = *((int32_t*)(buffer + offset - 1)) & 0x00FFFFFF;
     trackHolder->buffer[i] = sample * kScaleQ23ToFloat;
@@ -174,7 +176,7 @@
                                   BtifAvrcpAudioTrack* trackHolder) {
   size_t sampleSize = sampleSizeFor(trackHolder);
   size_t i = 0;
-  for (; i <= length / sampleSize; i++) {
+  for (; i < std::min(trackHolder->bufferLength, length / sampleSize); i++) {
     trackHolder->buffer[i] = ((int32_t*)buffer)[i] * kScaleQ31ToFloat;
   }
   return i * sampleSize;