From cca774644ea0b68c9518331fbdbff6bd588a26ac Mon Sep 17 00:00:00 2001 From: Jin Cheng Date: Sat, 11 Oct 2025 18:39:25 +0800 Subject: [PATCH] fix(bt/bluedroid): fixed buffer overflow in BRSF --- .../bt/host/bluedroid/bta/hf_client/bta_hf_client_at.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_at.c b/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_at.c index 1e3c3b00893..29276fdb3d3 100644 --- a/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_at.c +++ b/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_at.c @@ -1378,6 +1378,11 @@ void bta_hf_client_at_parse(char *buf, unsigned int len) osi_free(tmp_buff); } + /* prevent buffer overflow in cases where LEN exceeds available buffer space */ + if (len > BTA_HF_CLIENT_AT_PARSER_MAX_LEN - bta_hf_client_cb.scb.at_cb.offset) { + return; + } + memcpy(bta_hf_client_cb.scb.at_cb.buf + bta_hf_client_cb.scb.at_cb.offset, buf, len); bta_hf_client_cb.scb.at_cb.offset += len;