Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 11:10:54 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(bt/bluedroid): fixed possible OOB write in btc_a2dp_sink_handle_inc_media

Browse Source
This commit is contained in:
Jin Cheng
2026-06-30 14:42:00 +08:00
parent 1f3f53d226
commit 85d56bcd26
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/bt/host/bluedroid/btc/profile/std/a2dp/btc_a2dp_sink_ext_coedc.c
+6
View File
@@ -252,6 +252,12 @@ static void btc_a2dp_sink_handle_inc_media(BT_HDR *p_msg)
return; return;
} }
if (p_msg->offset < sizeof(UINT32)) {
APPL_TRACE_WARNING("%s: invalid offset %u for timestamp", __func__, p_msg->offset);
osi_free(p_msg);
return;
}
if (p_msg->layer_specific != a2dp_sink_local_param.media_pkt_seq_num.expected_seq_num) { if (p_msg->layer_specific != a2dp_sink_local_param.media_pkt_seq_num.expected_seq_num) {
/* Because the sequence number of some devices is not recounted */ /* Because the sequence number of some devices is not recounted */
if (!a2dp_sink_local_param.media_pkt_seq_num.seq_num_recount || if (!a2dp_sink_local_param.media_pkt_seq_num.seq_num_recount ||