Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 460d53a0 authored by Andre Eisenbach's avatar Andre Eisenbach Committed by Matthew Xie
Browse files

LE: Fix stack crash on invalid descriptor write request 

Fix stack crash when an application attempts to writes a NULL array
using the writeDescriptor() function.
bug 11574019
Change-Id: Id2d7e49216fcc6e3af369047005fb7e67e0923db
parent 9dc561f7

jni/com_android_bluetooth_gatt.cpp

+5 −0
Original line number Diff line number Diff line
@@ -991,6 +991,11 @@ static void gattClientWriteDescriptorNative(JNIEnv* env, jobject object, 
{

    if (!sGattIf) return;



    if (value == NULL) {

        warn("gattClientWriteDescriptorNative() ignoring NULL array");

        return;

    }



    btgatt_srvc_id_t srvc_id;

    srvc_id.id.inst_id = (uint8_t) service_id_inst_id;

    srvc_id.is_primary = (service_type == BTGATT_SERVICE_TYPE_PRIMARY ? 1 : 0);