Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8b69bbea authored by Jakub Pawlowski's avatar Jakub Pawlowski
Browse files

Make sure server response doesn't exceed maximum allowable length 

Bug: 78787521
Test: try sending response bigger than BTGATT_MAX_ATTR_LEN
Change-Id: I51b12483cced7e4c0d967acf5bb42559ef169fe7
Merged-In: I51b12483cced7e4c0d967acf5bb42559ef169fe7
(cherry picked from commit 0f34ae93)
parent 4a7f0f81

jni/com_android_bluetooth_gatt.cpp

+6 −1
Original line number Diff line number Diff line
@@ -1770,7 +1770,12 @@ static void gattServerSendResponseNative (JNIEnv *env, jobject object, 


    if (val != NULL)

    {

        if (env->GetArrayLength(val) < BTGATT_MAX_ATTR_LEN) {

            response.attr_value.len = (uint16_t)env->GetArrayLength(val);

        } else {

            android_errorWriteLog(0x534e4554, "78787521");

            response.attr_value.len = BTGATT_MAX_ATTR_LEN;

        }

        jbyte* array = env->GetByteArrayElements(val, 0);



        for (int i = 0; i != response.attr_value.len; ++i)