Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 23cf6d39 authored by Łukasz Rymanowski's avatar Łukasz Rymanowski Committed by Gerrit Code Review
Browse files

Merge "gatt: Fix crash if user use invalid attribute len"

parents 2cc75e03 49b31024

system/bta/gatt/bta_gattc_act.cc

+9 −4
Original line number Diff line number Diff line
@@ -996,11 +996,16 @@ void bta_gattc_write(tBTA_GATTC_CLCB* p_clcb, const tBTA_GATTC_DATA* p_data) { 
  attr.len = p_data->api_write.len;

  attr.auth_req = p_data->api_write.auth_req;



  /* Before coping to the fixed array, make sure it fits. */

  if (attr.len > GATT_MAX_ATTR_LEN) {

    status = GATT_INVALID_ATTR_LEN;

  } else {

    if (p_data->api_write.p_value)

      memcpy(attr.value, p_data->api_write.p_value, p_data->api_write.len);



    status =

        GATTC_Write(p_clcb->bta_conn_id, p_data->api_write.write_type, &attr);

  }



  /* write fail */

  if (status != GATT_SUCCESS) {