Merge "Make sure server response doesn't exceed maximum allowable length" into pi-dev (5f46e657) · Commits · e / os / android_packages_modules_Bluetooth

android/app/jni/com_android_bluetooth_gatt.cpp

+7 −1

Original line number	Original line	Diff line number	Diff line
	@@ -1645,7 +1645,13 @@ static void gattServerSendResponseNative(JNIEnv* env, jobject object,
	response.attr_value.len = 0;		response.attr_value.len = 0;

	if (val != NULL) {		if (val != NULL) {
			if (env->GetArrayLength(val) < BTGATT_MAX_ATTR_LEN) {
	response.attr_value.len = (uint16_t)env->GetArrayLength(val);		response.attr_value.len = (uint16_t)env->GetArrayLength(val);
			} else {
			android_errorWriteLog(0x534e4554, "78787521");
			response.attr_value.len = BTGATT_MAX_ATTR_LEN;
			}

	jbyte* array = env->GetByteArrayElements(val, 0);		jbyte* array = env->GetByteArrayElements(val, 0);

	for (int i = 0; i != response.attr_value.len; ++i)		for (int i = 0; i != response.attr_value.len; ++i)