Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 23b165b3 authored by Brian Delwiche's avatar Brian Delwiche Committed by Automerger Merge Worker
Browse files

Merge "Fix UAF in gatt_cl.cc" into udc-dev am: 055751eb am: 2de55e91 

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/22898163



Change-Id: I4d8fa76b8f887c7fea743d013fceb966403a3b16
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 8e824e43 2de55e91

system/stack/gatt/gatt_cl.cc

+6 −1
Original line number Diff line number Diff line
@@ -609,12 +609,17 @@ void gatt_process_prep_write_rsp(tGATT_TCB& tcb, tGATT_CLCB* p_clcb, 


  memcpy(value.value, p, value.len);



  bool subtype_is_write_prepare = (p_clcb->op_subtype == GATT_WRITE_PREPARE);



  if (!gatt_check_write_long_terminate(tcb, p_clcb, &value)) {

    gatt_send_prepare_write(tcb, p_clcb);

    return;

  }



  if (p_clcb->op_subtype == GATT_WRITE_PREPARE) {

  // We now know that we have not terminated, or else we would have returned

  // early.  We free the buffer only if the subtype is not equal to

  // GATT_WRITE_PREPARE, so checking here is adequate to prevent UAF.

  if (subtype_is_write_prepare) {

    /* application should verify handle offset

       and value are matched or not */

    gatt_end_operation(p_clcb, p_clcb->status, &value);