From ca55d63de82e41e2c672bfd2b707fc80911f30ce Mon Sep 17 00:00:00 2001 From: Jin Cheng Date: Mon, 15 Jun 2026 20:23:41 +0800 Subject: [PATCH] fix(bt/bluedroid): fixed possible OOB write in btc_a2dp_sink_handle_inc_media --- .../btc/profile/std/a2dp/btc_a2dp_sink_ext_coedc.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/components/bt/host/bluedroid/btc/profile/std/a2dp/btc_a2dp_sink_ext_coedc.c b/components/bt/host/bluedroid/btc/profile/std/a2dp/btc_a2dp_sink_ext_coedc.c index f01146ab6a8..1af7d862001 100644 --- a/components/bt/host/bluedroid/btc/profile/std/a2dp/btc_a2dp_sink_ext_coedc.c +++ b/components/bt/host/bluedroid/btc/profile/std/a2dp/btc_a2dp_sink_ext_coedc.c @@ -255,6 +255,12 @@ static void btc_a2dp_sink_handle_inc_media(BT_HDR *p_msg) return; } + if (p_msg->offset < sizeof(UINT32)) { + APPL_TRACE_WARNING("%s: invalid offset %u for timestamp", __func__, p_msg->offset); + osi_free(p_msg); + return; + } + if (p_msg->layer_specific != a2dp_sink_local_param.media_pkt_seq_num.expected_seq_num) { /* Because the sequence number of some devices is not recounted */ if (!a2dp_sink_local_param.media_pkt_seq_num.seq_num_recount ||