diff options
| author | Chienyuan <chienyuanhuang@google.com> | 2018-09-18 17:13:16 +0800 |
|---|---|---|
| committer | Tim Schumacher <timschumi@gmx.de> | 2019-02-10 12:18:19 +0100 |
| commit | 108912d72017f3273081c1106acd539bf8be7a6c (patch) | |
| tree | 3b167dab8800f9e7c162793d28a032ecd6f6e949 /stack/smp/smp_utils.c | |
| parent | 4258d0b4170bc75d0658911aa805e032b9642ef1 (diff) | |
| download | android_system_bt-108912d72017f3273081c1106acd539bf8be7a6c.tar.gz android_system_bt-108912d72017f3273081c1106acd539bf8be7a6c.tar.bz2 android_system_bt-108912d72017f3273081c1106acd539bf8be7a6c.zip | |
HFP: Check AT command buffer boundary during parsing
* add p_end parameter to tBTA_AG_AT_CMD_CBACK, bta_ag_at_hsp_cback
and bta_ag_at_hfp_cback to indicate effective data range of p_arg
* add checks for buffer copy overflow in bta_ag_at_hsp_cback and
bta_ag_at_hfp_cback
* add packet legnth checks with p_end in bta_ag_parse_cmer
* add packet length checks with p_end in bta_ag_parse_bac
Bug: 112860487
Test: testplans/details/218593/3975
Change-Id: I6bbbc2ba29ad025c7d3ba023d8191af6a11c4aa9
(cherry picked from commit 28ddbe904bd15c9636063f5431a9360d8e9df8b9)
CVE-2018-9583
Diffstat (limited to 'stack/smp/smp_utils.c')
0 files changed, 0 insertions, 0 deletions