Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2e6b8e8a authored by Richard Smith's avatar Richard Smith Committed by Jakub Pawlowski
Browse files

Fix out of bound read in read_reports_cb. 

Bug: 180939433
Change-Id: Ibd713c08cb18deb7b56347a842749d9aa85fba32
parent 180e0fe8

system/stack/btm/btm_ble_batchscan.cc

+5 −0
Original line number Diff line number Diff line
@@ -269,6 +269,11 @@ void read_reports_cb(std::vector<uint8_t> data_all, uint8_t num_records_all, 
    return;

  }



  if (len < 4) {

    BTM_TRACE_ERROR("%s: wrong length", __func__);

    return;

  }



  uint8_t report_format, num_records;

  STREAM_TO_UINT8(report_format, p);

  STREAM_TO_UINT8(num_records, p);