Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1c12e817 authored by Hansong Zhang's avatar Hansong Zhang
Browse files

GattServcer: Check invalid offset 

Test: manual
Bug: 143231677
Merged-In: I0396380f431cdb7f91c78db6de9043ea0f373dfe
Merged-In: I0ca22e7c60292d61c758120c1cd67f6e6edd8ae8
Change-Id: I0ca22e7c60292d61c758120c1cd67f6e6edd8ae8
parent f77eda03

system/service/gatt_server.cc

+7 −0
Original line number Diff line number Diff line
@@ -16,6 +16,7 @@ 


#include "service/gatt_server.h"



#include "osi/include/log.h"

#include "service/common/bluetooth/util/address_helper.h"

#include "service/logging_helpers.h"
@@ -126,6 +127,12 @@ bool GattServer::SendResponse(const std::string& device_address, int request_id, 
    return false;

  }



  if (offset < 0) {

    android_errorWriteLog(0x534e4554, "143231677");

    LOG(ERROR) << "Offset is less than 0 offset: " << offset;

    return false;

  }



  if (value.size() + offset > BTGATT_MAX_ATTR_LEN) {

    LOG(ERROR) << "Value is too large";

    return false;