Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 139e5f5c authored by Hui Peng's avatar Hui Peng
Browse files

Fix a few OOB bugs in StartAdvertisingSet 

Bug: 277590580
Test: atest net_test_main_shim
Ignore-AOSP-First: security
Tag: #security
Change-Id: Iff2c7f0364cf9f49933a3d557b9f3438ef6b37d0
parent 9addff4f

system/main/shim/le_advertising_manager.cc

+15 −0
Original line number Diff line number Diff line
@@ -192,6 +192,11 @@ class BleAdvertiserInterfaceImpl : public BleAdvertiserInterface, 
    while (offset < advertise_data.size()) {

      GapData gap_data;

      uint8_t len = advertise_data[offset];



      if (offset + len + 1 >= advertise_data.size()) {

        break;

      }



      auto begin = advertise_data.begin() + offset;

      auto end = begin + len + 1;  // 1 byte for len

      auto data_copy = std::make_shared<std::vector<uint8_t>>(begin, end);
@@ -206,6 +211,11 @@ class BleAdvertiserInterfaceImpl : public BleAdvertiserInterface, 
    while (offset < scan_response_data.size()) {

      GapData gap_data;

      uint8_t len = scan_response_data[offset];



      if (offset + len + 1 >= scan_response_data.size()) {

        break;

      }



      auto begin = scan_response_data.begin() + offset;

      auto end = begin + len + 1;  // 1 byte for len

      auto data_copy = std::make_shared<std::vector<uint8_t>>(begin, end);
@@ -220,6 +230,11 @@ class BleAdvertiserInterfaceImpl : public BleAdvertiserInterface, 
    while (offset < periodic_data.size()) {

      GapData gap_data;

      uint8_t len = periodic_data[offset];



      if (offset + len + 1 >= periodic_data.size()) {

        break;

      }



      auto begin = periodic_data.begin() + offset;

      auto end = begin + len + 1;  // 1 byte for len

      auto data_copy = std::make_shared<std::vector<uint8_t>>(begin, end);