commit 3a41065d41b4529c5ad3cc8e34dafd266522489f
author Ted Wang <tedwang@google.com> Tue Oct 06 20:20:16 2020 +0800
committer Ted Wang <tedwang@google.com> Wed Oct 07 09:12:32 2020 +0000
tree 2ffc742ea081910f552052b66c41cfe01cb5ddc0
parent 502d60e1e456c39ed3c09866a6da08246f76da71

Fix potential OOB write in libbluetooth

Check event id if of register notification command from remote to avoid
OOB write.

Tag: #security
Bug: 168802990
Test: atest net_test_btif

Change-Id: I90834b920d61bfb2df9414a25d73ba40033e4748
Merfed-In: I90834b920d61bfb2df9414a25d73ba40033e4748

stack/avrc/avrc_pars_tg.cc

diff --git a/stack/avrc/avrc_pars_tg.cc b/stack/avrc/avrc_pars_tg.cc
index fe1db3d..d15f3e2 100644
--- a/stack/avrc/avrc_pars_tg.cc
+++ b/stack/avrc/avrc_pars_tg.cc
@@ -304,6 +304,13 @@
         return AVRC_STS_INTERNAL_ERR;
       else {
         BE_STREAM_TO_UINT8(p_result->reg_notif.event_id, p);
+        if (!AVRC_IS_VALID_EVENT_ID(p_result->reg_notif.event_id)) {
+          android_errorWriteLog(0x534e4554, "168802990");
+          AVRC_TRACE_ERROR("%s: Invalid event id: %d", __func__,
+                           p_result->reg_notif.event_id);
+          return AVRC_STS_BAD_PARAM;
+        }
+
         BE_STREAM_TO_UINT32(p_result->reg_notif.param, p);
       }
       break;