GattServcer: Check invalid offset am: 1c12e817f4 (20a9d871) · Commits · e / os / android_packages_modules_Bluetooth

system/service/gatt_server.cc

+7 −0

Original line number	Diff line number	Diff line
		@@ -16,6 +16,7 @@

		#include "service/gatt_server.h"

		#include "osi/include/log.h"
		#include "service/common/bluetooth/util/address_helper.h"
		#include "service/logging_helpers.h"

		@@ -126,6 +127,12 @@ bool GattServer::SendResponse(const std::string& device_address, int request_id,
		return false;
		}

		if (offset < 0) {
		android_errorWriteLog(0x534e4554, "143231677");
		LOG(ERROR) << "Offset is less than 0 offset: " << offset;
		return false;
		}

		if (value.size() + offset > BTGATT_MAX_ATTR_LEN) {
		LOG(ERROR) << "Value is too large";
		return false;