Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 715a3b6c authored by Brian Delwiche's avatar Brian Delwiche Committed by Automerger Merge Worker
Browse files

Fix OOB write in build_read_multi_rsp of gatt_sr.cc am: e5ab6c61 am: 0a512694 am: 538fb74d 

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/28218275



Change-Id: I9a439a46401dc403c9d6a079e7da9bb9ec04a923
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents eca1b5bd 538fb74d

system/stack/eatt/eatt.h

+1 −0
Original line number Diff line number Diff line
@@ -99,6 +99,7 @@ class EattChannel { 


  void EattChannelSetTxMTU(uint16_t tx_mtu) {

    this->tx_mtu_ = std::min<uint16_t>(tx_mtu, EATT_MAX_TX_MTU);

    this->tx_mtu_ = std::max<uint16_t>(this->tx_mtu_, EATT_MIN_MTU_MPS);

  }

};

system/stack/gatt/gatt_sr.cc

+7 −0
Original line number Diff line number Diff line
@@ -149,6 +149,13 @@ static void build_read_multi_rsp(tGATT_SR_CMD* p_cmd, uint16_t mtu) { 
  uint8_t* p;

  bool is_overflow = false;



  // We need at least one extra byte for the opcode

  if (mtu == 0) {

    LOG(ERROR) << "Invalid MTU";

    p_cmd->status = GATT_ILLEGAL_PARAMETER;

    return;

  }



  len = sizeof(BT_HDR) + L2CAP_MIN_OFFSET + mtu;

  BT_HDR* p_buf = (BT_HDR*)osi_calloc(len);

  p_buf->offset = L2CAP_MIN_OFFSET;