commit 431e8d05cb961635657f490af2b2051a35520d54
author Hui Peng <phui@google.com> Sat Jan 14 02:54:06 2023 +0000
committer Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Tue Feb 14 18:18:44 2023 +0000
tree db77818beab4a4e16d4bea286fcf4a4d2b7313fe
parent f5e706e9d137166917a0e65aedf5ed5a25fa2c50

Fix an OOB bug in register_notification_rsp

Bug: 245916076
Test: manual
Ignore-AOSP-First: security
Change-Id: I901d973a736678d7f3cc816ddf0cbbcbbd1fe93f
(cherry picked from commit daa3efc5e53c8613f4b1a33e095ff6c6460b8d02)
Merged-In: I901d973a736678d7f3cc816ddf0cbbcbbd1fe93f

system/btif/src/btif_rc.cc

diff --git a/system/btif/src/btif_rc.cc b/system/btif/src/btif_rc.cc
index 1b68326..937cb15 100644
--- a/system/btif/src/btif_rc.cc
+++ b/system/btif/src/btif_rc.cc
@@ -1959,6 +1959,11 @@
                    dump_rc_notification_event_id(event_id));
   std::unique_lock<std::mutex> lock(btif_rc_cb.lock);
 
+  if (event_id > MAX_RC_NOTIFICATIONS) {
+    BTIF_TRACE_ERROR("Invalid event id");
+    return BT_STATUS_PARM_INVALID;
+  }
+
   memset(&(avrc_rsp.reg_notif), 0, sizeof(tAVRC_REG_NOTIF_RSP));
 
   avrc_rsp.reg_notif.event_id = event_id;