From 6cb20db4dfeee81314d0c55acb82f3f0e7679abe Mon Sep 17 00:00:00 2001 From: Jin Cheng Date: Mon, 15 Jun 2026 20:23:41 +0800 Subject: [PATCH] fix(bt/bluedroid): fixed possible OOB write in btc_a2dp_sink_handle_inc_media --- .../btc/profile/std/a2dp/btc_a2dp_sink_ext_coedc.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/components/bt/host/bluedroid/btc/profile/std/a2dp/btc_a2dp_sink_ext_coedc.c b/components/bt/host/bluedroid/btc/profile/std/a2dp/btc_a2dp_sink_ext_coedc.c index cb958679250..5968432a582 100644 --- a/components/bt/host/bluedroid/btc/profile/std/a2dp/btc_a2dp_sink_ext_coedc.c +++ b/components/bt/host/bluedroid/btc/profile/std/a2dp/btc_a2dp_sink_ext_coedc.c @@ -252,6 +252,12 @@ static void btc_a2dp_sink_handle_inc_media(BT_HDR *p_msg) return; } + if (p_msg->offset < sizeof(UINT32)) { + APPL_TRACE_WARNING("%s: invalid offset %u for timestamp", __func__, p_msg->offset); + osi_free(p_msg); + return; + } + if (p_msg->layer_specific != a2dp_sink_local_param.media_pkt_seq_num.expected_seq_num) { /* Because the sequence number of some devices is not recounted */ if (!a2dp_sink_local_param.media_pkt_seq_num.seq_num_recount ||