Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 26ba3a24 authored by Brian Delwiche's avatar Brian Delwiche Committed by Android (Google) Code Review
Browse files

Merge "Fix OOB write in build_read_multi_rsp of gatt_sr.cc" into main

parents 1b08684a cad92703

system/stack/eatt/eatt.h

+1 −0
Original line number Diff line number Diff line
@@ -100,6 +100,7 @@ class EattChannel { 


  void EattChannelSetTxMTU(uint16_t tx_mtu) {

    this->tx_mtu_ = std::min<uint16_t>(tx_mtu, EATT_MAX_TX_MTU);

    this->tx_mtu_ = std::max<uint16_t>(tx_mtu, EATT_MIN_MTU_MPS);

  }

};

system/stack/gatt/gatt_sr.cc

+7 −0
Original line number Diff line number Diff line
@@ -162,6 +162,13 @@ static void build_read_multi_rsp(tGATT_SR_CMD* p_cmd, uint16_t mtu) { 
  uint8_t* p;

  bool is_overflow = false;



  // We need at least one extra byte for the opcode

  if (mtu == 0) {

    log::error("Invalid MTU");

    p_cmd->status = GATT_ILLEGAL_PARAMETER;

    return;

  }



  len = sizeof(BT_HDR) + L2CAP_MIN_OFFSET + mtu;

  BT_HDR* p_buf = (BT_HDR*)osi_calloc(len);

  p_buf->offset = L2CAP_MIN_OFFSET;