tree faa1123782d69cc7040880494333eaf4dc792ae1
parent 2a7ab5cf369bac1c89a8f7e3db0fdfb1acf88fbb
author Brian Delwiche <delwiche@google.com> 1669941684 +0000
committer Bharath <bharath@teamb58.org> 1673528318 +0530

Report failure when not able to connect to AVRCP

A crash may occur when creating a bluetooth AVRCP connection to a
device.

The code fails to check a return value from an AVRCP function
being used to index into an array. The return value may exceed the
size of the array causing memory outside the bounds of the array to be
accessed leading to memory corruption and a crash.

The fix is to ensure the return value is within the bounds of the
array before accessing the array contents. If the return value is
not within the bounds of the array report it as a failure to the
bluetooth stack.

This change is relevant for android automotive because the IVI
(in-vehicle infotainment system) acts as the an AVRCP controller
which still executes this code.

Note: this is a backport of b/214569798, inducted as a non-security
issue.  Per b/226927612 it has been found to have security impact
and should be backported to earlier branches.

Bug: 226927612
Test: Manual - set return value to be out of bounds, verify no crash
Tag: #security
Ignore-AOSP-First: Security
Change-Id: I03f89f894c759b85e555a024435b625397ef7e5c
(cherry picked from commit 6a543761f2dc3db0ebf541285a0b3b2afc83a6a6)
Merged-In: I03f89f894c759b85e555a024435b625397ef7e5c