Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6ea75aae authored by Timothy Yiu's avatar Timothy Yiu Committed by Automerger Merge Worker
Browse files

Merge "Fix gatt_end_operation buffer overflow" into tm-dev am: e8779817 am:... 

Merge "Fix gatt_end_operation buffer overflow" into tm-dev am: e8779817 am: 01d3e82a am: 759c6733

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/22316109



Change-Id: I842743d829bce05e002ad07a9fb3a41c470e5440
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 8b3013d4 759c6733

system/stack/gatt/gatt_utils.cc

+7 −0
Original line number Diff line number Diff line
@@ -1619,6 +1619,13 @@ void gatt_end_operation(tGATT_CLCB* p_clcb, tGATT_STATUS status, void* p_data) { 
      cb_data.att_value.handle = p_clcb->s_handle;

      cb_data.att_value.len = p_clcb->counter;



      if (cb_data.att_value.len > GATT_MAX_ATTR_LEN) {

        LOG(WARNING) << __func__

                     << StringPrintf(" Large cb_data.att_value, size=%d",

                                     cb_data.att_value.len);

        cb_data.att_value.len = GATT_MAX_ATTR_LEN;

      }



      if (p_data && p_clcb->counter)

        memcpy(cb_data.att_value.value, p_data, cb_data.att_value.len);

    }