commit 9958895c7d2377b5f2aca9174c04e6bb61434ee0
author Ted Wang <tedwang@google.com> Tue Oct 06 20:20:16 2020 +0800
committer Ted Wang <tedwang@google.com> Wed Oct 07 09:17:54 2020 +0000
tree 7344e789d4ef3f85701e328670d69e75f5621713
parent 814160abca57badda240ff606444537c9d9e02df

Fix potential OOB write in libbluetooth

Check event id if of register notification command from remote to avoid
OOB write.

Tag: #security
Bug: 168802990
Test: atest net_test_btif

Change-Id: I90834b920d61bfb2df9414a25d73ba40033e4748
Merged-In: I90834b920d61bfb2df9414a25d73ba40033e4748

stack/avrc/avrc_pars_tg.cc

diff --git a/stack/avrc/avrc_pars_tg.cc b/stack/avrc/avrc_pars_tg.cc
index 12b7598..a9a36b0 100644
--- a/stack/avrc/avrc_pars_tg.cc
+++ b/stack/avrc/avrc_pars_tg.cc
@@ -302,6 +302,13 @@
         status = AVRC_STS_INTERNAL_ERR;
       else {
         BE_STREAM_TO_UINT8(p_result->reg_notif.event_id, p);
+        if (!AVRC_IS_VALID_EVENT_ID(p_result->reg_notif.event_id)) {
+          android_errorWriteLog(0x534e4554, "168802990");
+          AVRC_TRACE_ERROR("%s: Invalid event id: %d", __func__,
+                           p_result->reg_notif.event_id);
+          return AVRC_STS_BAD_PARAM;
+        }
+
         BE_STREAM_TO_UINT32(p_result->reg_notif.param, p);
       }
       break;