Merge "fix Out-of-bounds Write in bonded_devices array" (04c383ce) · Commits · e / os / android_packages_modules_Bluetooth

system/btif/src/btif_storage.cc

+12 −2

Original line number	Diff line number	Diff line
		@@ -486,7 +486,12 @@ static bt_status_t btif_in_fetch_bonded_devices(
		}
		}
		bt_linkkey_file_found = true;
		if (p_bonded_devices->num_devices < BTM_SEC_MAX_DEVICE_RECORDS) {
		p_bonded_devices->devices[p_bonded_devices->num_devices++] = bd_addr;
		} else {
		BTIF_TRACE_WARNING("%s: exceed the max number of bonded devices",
		__func__);
		}
		} else {
		bt_linkkey_file_found = false;
		}
		@@ -1369,7 +1374,12 @@ static bt_status_t btif_in_fetch_bonded_ble_device(

		// Fill in the bonded devices
		if (device_added) {
		if (p_bonded_devices->num_devices < BTM_SEC_MAX_DEVICE_RECORDS) {
		p_bonded_devices->devices[p_bonded_devices->num_devices++] = bd_addr;
		} else {
		BTIF_TRACE_WARNING("%s: exceed the max number of bonded devices",
		__func__);
		}
		btif_gatts_add_bonded_dev_from_nv(bd_addr);
		}