Merge "a2dp_fuzz : Bug Fix" (52286539) · Commits · e / os / android_packages_modules_Bluetooth

system/stack/test/fuzzers/sdp/sdpFuzzHelpers.h

+4 −1

Original line number	Original line	Diff line number	Diff line
	@@ -34,6 +34,8 @@
	#define SDP_MAX_ELEM_LEN 1024		#define SDP_MAX_ELEM_LEN 1024
	#define SDP_MAX_ATTRS 1024		#define SDP_MAX_ATTRS 1024

			constexpr int32_t kMaxVectorSize = 1000;

	struct SDP_Sequence_Helper {		struct SDP_Sequence_Helper {
	uint8_t num_elem;		uint8_t num_elem;
	std::shared_ptr<uint8_t> type;		std::shared_ptr<uint8_t> type;
	@@ -113,7 +115,8 @@ tSDP_DISC_ATVAL generateArbitrarySdpDiscAttrVal(FuzzedDataProvider* fdp) {
	std::shared_ptr<tSDP_DISC_ATTR> generateArbitrarySdpDiscAttr(		std::shared_ptr<tSDP_DISC_ATTR> generateArbitrarySdpDiscAttr(
	FuzzedDataProvider* fdp, bool allow_null) {		FuzzedDataProvider* fdp, bool allow_null) {
	// Give it a chance to return a nullptr		// Give it a chance to return a nullptr
	if (allow_null && !fdp->ConsumeBool()) {		if ((allow_null && !fdp->ConsumeBool()) \|\|
			sdp_disc_attr_vect.size() > kMaxVectorSize) {
	return nullptr;		return nullptr;
	}		}