Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 540bd3e7 authored by liuchao's avatar liuchao Committed by Pavlin Radoslavov
Browse files

NULL-pointer access before check in BTM_SetBleDataLength 

This fixes a potential NULL-pointer access in case
the ACL DB for the requested BDA is not found.

Test: mm -j 8

Change-Id: I86ab66730aa0d9a143ddde851bd33a05a405bb7f
parent c5eb43b7

system/stack/btm/btm_ble.cc

+15 −16
Original line number Diff line number Diff line
@@ -843,6 +843,13 @@ bool BTM_UseLeLink (BD_ADDR bd_addr) 
tBTM_STATUS BTM_SetBleDataLength(BD_ADDR bd_addr, uint16_t tx_pdu_length)

{

    tACL_CONN *p_acl = btm_bda_to_acl(bd_addr, BT_TRANSPORT_LE);



    if(p_acl == NULL)

    {

        BTM_TRACE_ERROR("%s: Wrong mode: no LE link exist or LE not supported",__func__);

        return BTM_WRONG_MODE;

    }



    BTM_TRACE_DEBUG("%s: tx_pdu_length =%d", __func__, tx_pdu_length);



    if (!controller_get_interface()->supports_ble_packet_extension())
@@ -857,8 +864,6 @@ tBTM_STATUS BTM_SetBleDataLength(BD_ADDR bd_addr, uint16_t tx_pdu_length) 
        return BTM_ILLEGAL_VALUE;

    }



    if (p_acl != NULL)

    {

    if (tx_pdu_length > BTM_BLE_DATA_SIZE_MAX)

        tx_pdu_length =  BTM_BLE_DATA_SIZE_MAX;

    else if (tx_pdu_length < BTM_BLE_DATA_SIZE_MIN)
@@ -870,12 +875,6 @@ tBTM_STATUS BTM_SetBleDataLength(BD_ADDR bd_addr, uint16_t tx_pdu_length) 


    return BTM_SUCCESS;

}

    else

    {

        BTM_TRACE_ERROR("%s: Wrong mode: no LE link exist or LE not supported",__func__);

        return BTM_WRONG_MODE;

    }

}



/*******************************************************************************

**