Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 00b34518 authored by Marie Janssen's avatar Marie Janssen Committed by android-build-merger
Browse files

DO NOT MERGE btif: check overflow on create_pbuf size am: 72025543 am: 9ea6af3a 

am: 743e1827

* commit '743e1827':
  DO NOT MERGE btif: check overflow on create_pbuf size

Change-Id: I1ed5ea4b978e5f9b6628a5443a0acc3e61c297d7
parents 456bf494 743e1827

system/btif/src/btif_hh.c

+8 −1
Original line number Original line Diff line number Diff line
@@ -33,6 +33,8 @@ 




#define LOG_TAG "bt_btif_hh"

#define LOG_TAG "bt_btif_hh"





#include <cutils/log.h>



#include "bta_api.h"

#include "bta_api.h"

#include "bta_hh_api.h"

#include "bta_hh_api.h"

#include "btif_storage.h"

#include "btif_storage.h"
@@ -254,7 +256,12 @@ static void toggle_os_keylockstates(int fd, int changedlockstates) 
*******************************************************************************/

*******************************************************************************/

static BT_HDR *create_pbuf(UINT16 len, UINT8 *data)

static BT_HDR *create_pbuf(UINT16 len, UINT8 *data)

{

{

    BT_HDR* p_buf = GKI_getbuf((UINT16) (len + BTA_HH_MIN_OFFSET + sizeof(BT_HDR)));

    UINT16 buflen = (UINT16) (len + BTA_HH_MIN_OFFSET + sizeof(BT_HDR));

    if (buflen < len) {

      android_errorWriteWithInfoLog(0x534e4554, "28672558", -1, NULL, 0);

      return NULL;

    }

    BT_HDR* p_buf = GKI_getbuf(buflen);





    if (p_buf) {

    if (p_buf) {

        UINT8* pbuf_data;

        UINT8* pbuf_data;