Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-01 18:50:34 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'bugfix/bbp_517' into 'master'

Browse Source 
fix(bt/bluedroid): fixed possible OOB read in btc_a2dp_sink_handle_inc_media

Closes BT-4398

See merge request espressif/esp-idf!49673
This commit is contained in:
Wang Meng Yang
2026-06-18 15:14:47 +08:00
parent 3963be89f4 6cb20db4df
commit 371f92bf8a
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/bt/host/bluedroid/btc/profile/std/a2dp/btc_a2dp_sink_ext_coedc.c
+6
View File
@@ -252,6 +252,12 @@ static void btc_a2dp_sink_handle_inc_media(BT_HDR *p_msg)
return;
}
if (p_msg->offset < sizeof(UINT32)) {
APPL_TRACE_WARNING("%s: invalid offset %u for timestamp", __func__, p_msg->offset);
osi_free(p_msg);
return;
}
if (p_msg->layer_specific != a2dp_sink_local_param.media_pkt_seq_num.expected_seq_num) {
/* Because the sequence number of some devices is not recounted */
if (!a2dp_sink_local_param.media_pkt_seq_num.seq_num_recount ||