commit 00a4ad050bb46442e2c38435de48e8d34f14e81f
author Pavlin Radoslavov <pavlin@google.com> Thu Jul 06 16:58:24 2017 -0700
committer JP Sugarbroad <jpsugar@google.com> Tue Aug 29 16:44:16 2017 -0700
tree 46aea74e5127e897f19053c94b8832d6ea251e67
parent 1e10013bfeacf2715a27fa465bb96c4bed37519c

Add a missing check for PAN buffer size before copying data

Bug: 63146237
Test: External script
Change-Id: I3e9c8a767a8a2a80ff56ccb48c56ca0d4b8c3402
Merged-In: I3e9c8a767a8a2a80ff56ccb48c56ca0d4b8c3402
(cherry picked from commit 1d909399cb4259243dac2e531e3ce6ca1afa77e7)

bta/pan/bta_pan_act.cc

diff --git a/bta/pan/bta_pan_act.cc b/bta/pan/bta_pan_act.cc
index ecc8212..c559993 100644
--- a/bta/pan/bta_pan_act.cc
+++ b/bta/pan/bta_pan_act.cc
@@ -28,6 +28,8 @@
 
 #include <string.h>
 
+#include <cutils/log.h>
+
 #include "bt_common.h"
 #include "bta_api.h"
 #include "bta_pan_api.h"
@@ -174,6 +176,14 @@
 
   if (sizeof(tBTA_PAN_DATA_PARAMS) > p_buf->offset) {
     /* offset smaller than data structure in front of actual data */
+    if (sizeof(BT_HDR) + sizeof(tBTA_PAN_DATA_PARAMS) + p_buf->len >
+        PAN_BUF_SIZE) {
+      android_errorWriteLog(0x534e4554, "63146237");
+      APPL_TRACE_ERROR("%s: received buffer length too large: %d", __func__,
+                       p_buf->len);
+      osi_free(p_buf);
+      return;
+    }
     p_new_buf = (BT_HDR*)osi_malloc(PAN_BUF_SIZE);
     memcpy((uint8_t*)(p_new_buf + 1) + sizeof(tBTA_PAN_DATA_PARAMS),
            (uint8_t*)(p_buf + 1) + p_buf->offset, p_buf->len);