| commit | e8fccd25c9e3650990ff8c9d30370d12c5eb90f9 | [log] [tgz] |
|---|---|---|
| author | Paul Colta <donpaul@google.com> | Thu Jun 01 19:44:47 2023 +0000 |
| committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | Thu Jun 01 19:44:47 2023 +0000 |
| tree | 07b5ecabc7524d140595f753f2e2e4b2da1c6f4a | |
| parent | 5ee1e4f02eb33277a8977672f06750787b3530f4 [diff] | |
| parent | a93bdd057828d0f29707a378d7a4de259be74839 [diff] |
HDMICEC: Out of Bounds Write in sendMessage in HdmiCec.cpp am: a93bdd0578 Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/23486967 Change-Id: I5432179a2b5deb6d6d764ddf7da044e6e4010dee Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
diff --git a/tv/cec/1.0/default/HdmiCec.cpp b/tv/cec/1.0/default/HdmiCec.cpp index 74de785..f05f610 100644 --- a/tv/cec/1.0/default/HdmiCec.cpp +++ b/tv/cec/1.0/default/HdmiCec.cpp
@@ -307,6 +307,9 @@ } Return<SendMessageResult> HdmiCec::sendMessage(const CecMessage& message) { + if (message.body.size() > CEC_MESSAGE_BODY_MAX_LENGTH) { + return SendMessageResult::FAIL; + } cec_message_t legacyMessage { .initiator = static_cast<cec_logical_address_t>(message.initiator), .destination = static_cast<cec_logical_address_t>(message.destination),