commit d03ad447546e1f71b55782d75a0251ec0b63d6b9
author Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Tue Feb 14 18:43:29 2023 +0000
committer Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Tue Feb 14 18:43:29 2023 +0000
tree c2931c012653c0a5aaabf63325a1b1239409f219
parent 89b6f9c19350b7892ba385ff958355891ffc0e09
parent b9b46191d5e1854c4f77c64ef023870b574dd896

Merge cherrypicks of ['googleplex-android-review.googlesource.com/20672923', 'googleplex-android-review.googlesource.com/21060030'] into rvc-platform-release.

Change-Id: I470d1ae5ac7321d9f2af2a64223c964a86271ed3

btif/src/btif_rc.cc

diff --git a/btif/src/btif_rc.cc b/btif/src/btif_rc.cc
index 9fc221e..b93a6bf 100755
--- a/btif/src/btif_rc.cc
+++ b/btif/src/btif_rc.cc
@@ -1968,6 +1968,11 @@
                    dump_rc_notification_event_id(event_id));
   std::unique_lock<std::mutex> lock(btif_rc_cb.lock);
 
+  if (event_id > MAX_RC_NOTIFICATIONS) {
+    BTIF_TRACE_ERROR("Invalid event id");
+    return BT_STATUS_PARM_INVALID;
+  }
+
   memset(&(avrc_rsp.reg_notif), 0, sizeof(tAVRC_REG_NOTIF_RSP));
 
   avrc_rsp.reg_notif.event_id = event_id;

stack/avdt/avdt_scb_act.cc

diff --git a/stack/avdt/avdt_scb_act.cc b/stack/avdt/avdt_scb_act.cc
index ce53c45..f2de4ba 100644
--- a/stack/avdt/avdt_scb_act.cc
+++ b/stack/avdt/avdt_scb_act.cc
@@ -255,19 +255,24 @@
     if (offset > len) goto length_error;
     p += 2;
     BE_STREAM_TO_UINT16(ex_len, p);
-    offset += ex_len * 4;
     p += ex_len * 4;
   }
 
+  if ((p - p_start) >= len) {
+    AVDT_TRACE_WARNING("%s: handling malformatted packet: ex_len too large", __func__);
+    osi_free_and_reset((void**)&p_data->p_pkt);
+    return;
+  }
+  offset = p - p_start;
+
   /* adjust length for any padding at end of packet */
   if (o_p) {
     /* padding length in last byte of packet */
-    pad_len = *(p_start + p_data->p_pkt->len);
+    pad_len = *(p_start + len - 1);
   }
 
   /* do sanity check */
-  if ((offset > p_data->p_pkt->len) ||
-      ((pad_len + offset) > p_data->p_pkt->len)) {
+  if (pad_len >= (len - offset)) {
     AVDT_TRACE_WARNING("Got bad media packet");
     osi_free_and_reset((void**)&p_data->p_pkt);
   }