1. b370c30 Revert "Revert "Fix wrong BR/EDR link key downgrades (P_256->P_192)"" by Brian Delwiche · 1 year, 3 months ago
  2. a063539 Revert "Revert "[RESTRICT AUTOMERGE] Validate buffer length in sdpu_build_uuid_seq"" by Brian Delwiche · 1 year, 3 months ago
  3. 1671d8e Fix OOB access in avdt_scb_hdl_pkt_no_frag by Hui Peng · 1 year, 6 months ago
  4. 5f07777 Revert "Fix OOB access in avdt_scb_hdl_pkt_no_frag" by Bharath · 1 year, 3 months ago
  5. b6e04a6 Fix OOB access in avdt_scb_hdl_pkt_no_frag by Hui Peng · 1 year, 6 months ago
  6. 9c7feee Fix an OOB write in SDP_AddAttribute by Hui Peng · 1 year, 5 months ago
  7. e0c6fa5 Fix an OOB access bug in A2DP_BuildMediaPayloadHeaderSbc by Hui Peng · 1 year, 5 months ago
  8. f3046d1 Fix an OOB Write bug in gatt_check_write_long_terminate by Hui Peng · 1 year, 5 months ago
  9. 1a40ba5 Add bounds check in avdt_scb_act.cc by Brian Delwiche · 1 year, 8 months ago
  10. 2a7ab5c AVDTP: Fix a potential overflow about the media payload offset by Mayank Madhukar · 1 year, 11 months ago rel/11/fp3/8901.4.A.0019 rel/11/fp3/8901.4.A.0019.1 rel/11/fp3/8901.4.A.0019.2
  11. 08ab03f Merge branch 'dev/11/fp3/security-aosp-rvc-release' into int/11/fp3 by Bharath · 1 year, 7 months ago
  12. decde98 Fix integer overflow when parsing avrc response by Keith Mok · 1 year, 10 months ago
  13. 3257380 Add length check when copy AVDT and AVCT packet by Keith Mok · 1 year, 10 months ago
  14. 6a3bfd0 Add missing increment in bnep_api.cc by Brian Delwiche · 1 year, 10 months ago
  15. 5e6d7ef RESTRICT AUTOMERGE Added max buffer length check by Brian Delwiche · 1 year, 10 months ago
  16. cca4467 Add length check when copy AVDTP packet by Ted Wang · 1 year, 10 months ago
  17. 4740963 Merge branch 'dev/11/fp3/security-aosp-rvc-release' into int/11/fp3 by Bharath · 1 year, 8 months ago
  18. cf71dd2 Add negative length check in process_service_search_rsp by Brian Delwiche · 1 year, 10 months ago
  19. ada5a72 Merge branch 'dev/11/fp3/security-aosp-rvc-release' into int/11/fp3 by Bharath · 1 year, 9 months ago rel/11/fp3/8901.4.A.0017 rel/11/fp3/8901.4.A.0017.3
  20. da0c8cc Fix potential interger overflow when parsing vendor response by Ted Wang · 2 years, 2 months ago
  21. be15209 Merge tag 'android-security-11.0.0_r57' into int/11/fp3 by Bharath · 1 year, 11 months ago
  22. dcb1955 Check Avrcp packet vendor length before extracting length by William Escande · 2 years, 1 month ago
  23. 944bc6e Merge tag 'android-security-11.0.0_r54' into int/11/fp3 by Bharath · 2 years, 1 month ago
  24. 25a8855 Security fix OOB read due to invalid count in stack/avrc/avrc_pars_ct by Ted Wang · 2 years, 5 months ago
  25. de6e378 security: Use-After-Free in btm_sec_[dis]connected by Chris Manton · 2 years, 7 months ago
  26. e4fe647 Merge tag 'android-11.0.0_r48' into int/11/fp3 by Karsten Tausche · 2 years, 6 months ago
  27. 482e044 Merge mpr-2021-07-05 by Eric Arseneau · 2 years, 11 months ago
  28. 10f7c3b SMP: Reject pairing if public_key.x match by Hansong Zhang · 3 years ago
  29. 98082ad Fix memory overflow. by Richard Smith · 3 years, 4 months ago
  30. 4f99668 SMP: Reject pairing if public_key.x match by Hansong Zhang · 3 years ago
  31. d44ab6f Merge mpr-2021-06-05 by Eric Arseneau · 3 years ago
  32. fa1c635 Fix memory overflow. by Richard Smith · 3 years, 4 months ago
  33. b58e324 Fix memory overflow. by Richard Smith · 3 years, 4 months ago
  34. 401f2b7 Merge mpr-2021-05-05 by Eric Arseneau · 3 years, 1 month ago
  35. 3cce102 RESTRICT AUTOMERGE Contain avrc_ctrl_pars_vendor_cmd OOB write by Chris Manton · 3 years, 3 months ago
  36. 2f92ff9 Check packet size in avrc_pars_browse_rsp by Hansong Zhang · 3 years, 4 months ago
  37. 7c53ee5 smp: Use SMP_TRACE_WARNING by Myles Watson · 3 years, 3 months ago
  38. 776ec9a smp: Reject pairing if the public keys match by Myles Watson · 3 years, 4 months ago
  39. d0dbfc5 Merge mpr-2021-04-05 by Eric Arseneau · 3 years, 2 months ago
  40. bf9310d RESTRICT AUTOMERGE Contain avrc_ctrl_pars_vendor_cmd OOB write by Chris Manton · 3 years, 3 months ago
  41. 0e4254a Merge "Check packet size in avrc_pars_browse_rsp" into rvc-dev am: 05401e8739 by TreeHugger Robot · 3 years, 2 months ago
  42. 05401e8 Merge "Check packet size in avrc_pars_browse_rsp" into rvc-dev by TreeHugger Robot · 3 years, 2 months ago
  43. 2cafe07 avrcp: Ignore AVCT commands that are too long by Myles Watson · 3 years, 4 months ago
  44. 5f3b168 smp: Use SMP_TRACE_WARNING by Myles Watson · 3 years, 3 months ago
  45. 3ad001d smp: Reject pairing if the public keys match by Myles Watson · 3 years, 4 months ago
  46. d02ba82 avrcp: Ignore AVCT commands that are too long by Myles Watson · 3 years, 4 months ago
  47. 11cefea Merge spl-2021-03-05 by Eric Arseneau · 3 years, 3 months ago
  48. a083e78 Merge "avrcp: Ignore AVCT commands that are too long" into oc-mr1-dev am: c89971ccbb am: c1282f371b am: fc6a2327ac am: b01c117452 am: ac3fb23588 by TreeHugger Robot · 3 years, 3 months ago
  49. ac3fb23 Merge "avrcp: Ignore AVCT commands that are too long" into oc-mr1-dev am: c89971ccbb am: c1282f371b am: fc6a2327ac am: b01c117452 by TreeHugger Robot · 3 years, 3 months ago
  50. b01c117 Merge "avrcp: Ignore AVCT commands that are too long" into oc-mr1-dev am: c89971ccbb am: c1282f371b am: fc6a2327ac by TreeHugger Robot · 3 years, 3 months ago
  51. fc6a232 Merge "avrcp: Ignore AVCT commands that are too long" into oc-mr1-dev am: c89971ccbb am: c1282f371b by TreeHugger Robot · 3 years, 3 months ago
  52. c1282f3 Merge "avrcp: Ignore AVCT commands that are too long" into oc-mr1-dev am: c89971ccbb by TreeHugger Robot · 3 years, 3 months ago
  53. c89971c Merge "avrcp: Ignore AVCT commands that are too long" into oc-mr1-dev by TreeHugger Robot · 3 years, 3 months ago
  54. 0cce7e3 smp: Use SMP_TRACE_WARNING am: 4567823871 am: 3d5118b2ae am: db97c71539 am: 7447be7dd5 by Myles Watson · 3 years, 3 months ago
  55. 7447be7 smp: Use SMP_TRACE_WARNING am: 4567823871 am: 3d5118b2ae am: db97c71539 by Myles Watson · 3 years, 3 months ago
  56. db97c71 smp: Use SMP_TRACE_WARNING am: 4567823871 am: 3d5118b2ae by Myles Watson · 3 years, 3 months ago
  57. 3d5118b smp: Use SMP_TRACE_WARNING am: 4567823871 by Myles Watson · 3 years, 3 months ago
  58. a58ff17 smp: Reject pairing if the public keys match am: b7e176df4b am: 384a93f2b5 am: d7649413ad am: d501a765c9 by Myles Watson · 3 years, 3 months ago
  59. 4567823 smp: Use SMP_TRACE_WARNING by Myles Watson · 3 years, 3 months ago
  60. d501a76 smp: Reject pairing if the public keys match am: b7e176df4b am: 384a93f2b5 am: d7649413ad by Myles Watson · 3 years, 3 months ago
  61. d764941 smp: Reject pairing if the public keys match am: b7e176df4b am: 384a93f2b5 by Myles Watson · 3 years, 3 months ago
  62. 384a93f smp: Reject pairing if the public keys match am: b7e176df4b by Myles Watson · 3 years, 3 months ago
  63. 6e3c984 Check packet size in avrc_pars_browse_rsp by Hansong Zhang · 3 years, 4 months ago
  64. 20305ba avrc_copy_packet: Zero initialize packet by Hansong Zhang · 3 years, 6 months ago
  65. 026f04c AVRCP: Use calloc to zero reserved fields by Myles Watson · 3 years, 6 months ago
  66. e37d3b3 Legacy pairing: Reject device with same BD_ADDR by Hansong Zhang · 3 years, 6 months ago
  67. b7e176d smp: Reject pairing if the public keys match by Myles Watson · 3 years, 4 months ago
  68. 3e7199d AVRCP: Use calloc to zero reserved fields by Myles Watson · 3 years, 6 months ago
  69. fec472c avrc_copy_packet: Zero initialize packet by Hansong Zhang · 3 years, 6 months ago
  70. 9e65d22 Legacy pairing: Reject device with same BD_ADDR by Hansong Zhang · 3 years, 6 months ago
  71. dc07e92 avrcp: Ignore AVCT commands that are too long by Myles Watson · 3 years, 4 months ago
  72. cb0380b Merge "avrc_copy_packet: Zero initialize packet" into oc-mr1-dev am: 63480b1eee am: 131b92ac3f am: 6e271b0519 am: 8b3ad63b70 am: 3e928d15e1 by Myles Watson · 3 years, 4 months ago
  73. 3e928d1 Merge "avrc_copy_packet: Zero initialize packet" into oc-mr1-dev am: 63480b1eee am: 131b92ac3f am: 6e271b0519 am: 8b3ad63b70 by Myles Watson · 3 years, 4 months ago
  74. 8b3ad63 Merge "avrc_copy_packet: Zero initialize packet" into oc-mr1-dev am: 63480b1eee am: 131b92ac3f am: 6e271b0519 by Myles Watson · 3 years, 4 months ago
  75. 6e271b0 Merge "avrc_copy_packet: Zero initialize packet" into oc-mr1-dev am: 63480b1eee am: 131b92ac3f by Myles Watson · 3 years, 4 months ago
  76. 131b92a Merge "avrc_copy_packet: Zero initialize packet" into oc-mr1-dev am: 63480b1eee by Myles Watson · 3 years, 4 months ago
  77. 63480b1 Merge "avrc_copy_packet: Zero initialize packet" into oc-mr1-dev by Myles Watson · 3 years, 4 months ago
  78. 90cb68e Merge spl-2021-01-05 by Eric Arseneau · 3 years, 5 months ago
  79. 52c06e7 Merge "AVRCP: Use calloc to zero reserved fields" into pi-dev by TreeHugger Robot · 3 years, 5 months ago
  80. 027fde8 Merge spl-2020-12-05 by Eric Arseneau · 3 years, 6 months ago
  81. a71d9b5 Merge "Legacy pairing: Reject device with same BD_ADDR" into oc-mr1-dev am: 93346eae3a am: 522313bb33 am: 2bd6cbf058 am: 3981ced364 am: 1aa74d4478 am: 161f1354da by TreeHugger Robot · 3 years, 5 months ago
  82. 161f135 Merge "Legacy pairing: Reject device with same BD_ADDR" into oc-mr1-dev am: 93346eae3a am: 522313bb33 am: 2bd6cbf058 am: 3981ced364 am: 1aa74d4478 by TreeHugger Robot · 3 years, 5 months ago
  83. 1aa74d4 Merge "Legacy pairing: Reject device with same BD_ADDR" into oc-mr1-dev am: 93346eae3a am: 522313bb33 am: 2bd6cbf058 am: 3981ced364 by TreeHugger Robot · 3 years, 5 months ago
  84. 3981ced Merge "Legacy pairing: Reject device with same BD_ADDR" into oc-mr1-dev am: 93346eae3a am: 522313bb33 am: 2bd6cbf058 by TreeHugger Robot · 3 years, 5 months ago
  85. 2bd6cbf Merge "Legacy pairing: Reject device with same BD_ADDR" into oc-mr1-dev am: 93346eae3a am: 522313bb33 by TreeHugger Robot · 3 years, 5 months ago
  86. 522313b Merge "Legacy pairing: Reject device with same BD_ADDR" into oc-mr1-dev am: 93346eae3a by TreeHugger Robot · 3 years, 5 months ago
  87. 41584e8 AVRCP: Use calloc to zero reserved fields by Myles Watson · 3 years, 6 months ago
  88. 93346ea Merge "Legacy pairing: Reject device with same BD_ADDR" into oc-mr1-dev by TreeHugger Robot · 3 years, 5 months ago
  89. 0f447e4 avrc_copy_packet: Zero initialize packet by Hansong Zhang · 3 years, 6 months ago
  90. 8d461a8 AVRCP: Use calloc to zero reserved fields by Myles Watson · 3 years, 6 months ago
  91. 374bb04 Legacy pairing: Reject device with same BD_ADDR by Hansong Zhang · 3 years, 6 months ago
  92. f328ab4 Fix potential OOB write in libbluetooth by Ted Wang · 3 years, 8 months ago
  93. 54129f8 Fix potential OOB write in libbluetooth by Ted Wang · 3 years, 8 months ago
  94. 01fff3a Disable sniff for faulty remotes by Venkata Jagadeesh Garaga · 5 years ago
  95. b4dc4cf Merge spl-2020-11-05 by Eric Arseneau · 3 years, 7 months ago
  96. 2d42b47 Merge "Fix potential OOB write in libbluetooth" into rvc-dev am: 5473887e4c by TreeHugger Robot · 3 years, 7 months ago
  97. a5a22d6 Merge "Fix potential OOB write in libbluetooth" into rvc-qpr-dev by TreeHugger Robot · 3 years, 7 months ago
  98. e1aed6e Merge "Fix potential OOB write in libbluetooth" into oc-mr1-dev by TreeHugger Robot · 3 years, 7 months ago
  99. 94c5c10 Merge "Fix potential OOB write in libbluetooth" into qt-dev by TreeHugger Robot · 3 years, 7 months ago
  100. 5473887 Merge "Fix potential OOB write in libbluetooth" into rvc-dev by TreeHugger Robot · 3 years, 7 months ago