tree d3e2e3650fb1eb86b6695f3bde66b12b862f2ea5
parent 88da2721d4eae2610f4fc863d08b22d93b8bc951
author Brian Delwiche <delwiche@google.com> 1665523402 +0000
committer Android Build Coastguard Worker <android-build-coastguard-worker@google.com> 1680741577 +0000

Prevent use-after-free of HID reports

BTA sends the the HID report pointer to BTIF and deallocates it immediately.
This is now prevented by providing a deep copy callback function for HID
reports when tranferring context from BTA to BTIF.

This is a backport of change Icef7a7ed1185b4283ee4fe4f812ca154d8f1b825,
already merged on T for b/227620181.

Bug: 228837201
Test: Validated against researcher POC, ran BT unit tests, played audio
manually.
Tag: #security
Ignore-AOSP-First: Security
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:874c495c886cd8722625756dc5fd0634b16b4f42)
Merged-In: Ib837f395883de2369207f1b3b974d6bff02dcb19
Change-Id: Ib837f395883de2369207f1b3b974d6bff02dcb19