tree eb2529667e5267a29bf347cc3c1d6d0b9b006557
parent e090a3dfb8ab5cb7216587daea8ecac8ece7e511
author Hui Peng <phui@google.com> 1683767404 +0000
committer Android Build Coastguard Worker <android-build-coastguard-worker@google.com> 1693569983 +0000

Fix multiple OOB bugs resulted from tx mtu in EATT

The tx mtu in EATT can be controlled by remote device. With malicious
mtu values, it is possible to trigger integer overflow and
OOB write at multiple places (see the bug below).

This fix enforces a max tx mtu in EATT.

Bug: 271335899
Test: manual
Ignore-AOSP-First: security
Tag: #security
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:282d4a182ea6a7d2e6e0f6901d2bc1e75b49e52f)
Merged-In: Ia06c9a17f2daa5ce4c32cffa536777f47774cf31
Change-Id: Ia06c9a17f2daa5ce4c32cffa536777f47774cf31