Add BT_HDR length check for received AVCTP packets
Bug: 79944113
Test: Code compilation
Change-Id: I02c76ab8fad61669394062bf34656ea32f465b6a
Merged-In: I02c76ab8fad61669394062bf34656ea32f465b6a
(cherry picked from commit 4262b932e487b19d578d79e0120cf03291f44efc)
(cherry picked from commit fa538540a7f147b8440ac49735a8dc596ce8dfc7)
diff --git a/stack/avct/avct_bcb_act.cc b/stack/avct/avct_bcb_act.cc
index 70d8ce7..011a52d 100644
--- a/stack/avct/avct_bcb_act.cc
+++ b/stack/avct/avct_bcb_act.cc
@@ -69,6 +69,12 @@
uint8_t* p;
uint8_t pkt_type;
+ if (p_buf->len == 0) {
+ osi_free_and_reset((void**)&p_buf);
+ android_errorWriteLog(0x534e4554, "79944113");
+ return nullptr;
+ }
+
/* parse the message header */
p = (uint8_t*)(p_buf + 1) + p_buf->offset;
pkt_type = AVCT_PKT_TYPE(p);