Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 41a43e35 authored by Himanshu Rawat's avatar Himanshu Rawat Committed by Automerger Merge Worker
Browse files

Merge "Out of bound access if the handle or transport type is wrong" into main am: fca6e070 

Original change: https://android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/2660938



Change-Id: Id001e37915d8ecb651d97b2cc45368506bc91fc1
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents cb1845e4 fca6e070

system/bta/hh/bta_hh_utils.cc

+12 −5
Original line number Diff line number Diff line
@@ -117,13 +117,20 @@ tBTA_HH_DEV_CB* bta_hh_get_cb(const RawAddress& bda) { 
void bta_hh_clean_up_kdev(tBTA_HH_DEV_CB* p_cb) {

  uint8_t index;



  if (p_cb->hid_handle != BTA_HH_INVALID_HANDLE) {

    if (p_cb->is_le_device)

      bta_hh_cb.le_cb_index[BTA_HH_GET_LE_CB_IDX(p_cb->hid_handle)] =

          BTA_HH_IDX_INVALID;

    else

  if (p_cb->is_le_device) {

    uint8_t le_hid_handle = BTA_HH_GET_LE_CB_IDX(p_cb->hid_handle);

    if (le_hid_handle >= BTA_HH_LE_MAX_KNOWN) {

      LOG_WARN("Invalid LE hid_handle %d", p_cb->hid_handle);

    } else {

      bta_hh_cb.le_cb_index[le_hid_handle] = BTA_HH_IDX_INVALID;

    }

  } else {

    if (p_cb->hid_handle >= BTA_HH_MAX_KNOWN) {

      LOG_WARN("Invalid hid_handle %d", p_cb->hid_handle);

    } else {

      bta_hh_cb.cb_index[p_cb->hid_handle] = BTA_HH_IDX_INVALID;

    }

  }



  /* reset device control block */

  index = p_cb->index; /* Preserve index for this control block */