Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 112ce0e5 authored by Hui Peng's avatar Hui Peng
Browse files

Fix a potential OOB in BleAdvertiserVscHciInterfaceImpl::VendorSpecificEventCback 

Bug: 264921486
Test: manual
Ignore-AOSP-First: security
Tag: #security
Change-Id: Ifed6a81c2a980394efbd5666305d10227d5ec186
parent 638e4875

system/stack/btm/ble_advertiser_hci_interface.cc

+5 −1
Original line number Diff line number Diff line
@@ -294,10 +294,14 @@ class BleAdvertiserVscHciInterfaceImpl : public BleAdvertiserHciInterface { 
    uint8_t sub_event, adv_inst, change_reason;

    uint16_t conn_handle;



    if (length < 1) {

      return;

    }



    STREAM_TO_UINT8(sub_event, p);

    length--;



    if (sub_event != HCI_VSE_SUBCODE_BLE_MULTI_ADV_ST_CHG || length != 4) {

    if (sub_event != HCI_VSE_SUBCODE_BLE_MULTI_ADV_ST_CHG || length < 4) {

      return;

    }