Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6fe963e2 authored by Ugo Yu's avatar Ugo Yu
Browse files

DO NOT MERGE Fix OOB read before buffer length check 

Bug: 111936834
Test: manual
Change-Id: I60c500651f130876934a7b80889f4e021055fe73
parent 88883058

system/stack/smp/smp_act.c

+5 −1
Original line number Diff line number Diff line
@@ -823,14 +823,18 @@ void smp_process_keypress_notification(tSMP_CB *p_cb, tSMP_INT_DATA *p_data) 
    UINT8 reason = SMP_INVALID_PARAMETERS;



    SMP_TRACE_DEBUG("%s", __func__);

    p_cb->status = *(UINT8 *)p_data;



    if (smp_command_has_invalid_parameters(p_cb))

    {

        if (p_cb->rcvd_cmd_len < 2) {  // 1 (opcode) + 1 (Notif Type) bytes

            android_errorWriteLog(0x534e4554, "111936834");

        }

        smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);

        return;

    }



    p_cb->status = *(UINT8 *)p_data;



    if (p != NULL)

    {

        STREAM_TO_UINT8(p_cb->peer_keypress_notification, p);