Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6670de5f authored by Łukasz Rymanowski's avatar Łukasz Rymanowski Committed by Automerger Merge Worker
Browse files

Merge "gatt: Fix crash if user use invalid attribute len" am: 23cf6d39 

Original change: https://android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/2387852



Change-Id: I28ced96aad79b32a3c5dae0ddd3da07628d36dfb
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 0ea5d98f 23cf6d39

system/bta/gatt/bta_gattc_act.cc

+9 −4
Original line number Diff line number Diff line
@@ -996,11 +996,16 @@ void bta_gattc_write(tBTA_GATTC_CLCB* p_clcb, const tBTA_GATTC_DATA* p_data) { 
  attr.len = p_data->api_write.len;

  attr.auth_req = p_data->api_write.auth_req;



  /* Before coping to the fixed array, make sure it fits. */

  if (attr.len > GATT_MAX_ATTR_LEN) {

    status = GATT_INVALID_ATTR_LEN;

  } else {

    if (p_data->api_write.p_value)

      memcpy(attr.value, p_data->api_write.p_value, p_data->api_write.len);



    status =

        GATTC_Write(p_clcb->bta_conn_id, p_data->api_write.write_type, &attr);

  }



  /* write fail */

  if (status != GATT_SUCCESS) {