Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 73827ac5 authored by Hui Peng's avatar Hui Peng
Browse files

Fix an OOB bug in btm_ble_add_resolving_list_entry_complete 

Regression test: Ie8c6cb188cf7cde94d2f7dc0db04b3de51e08678

Bug: 260078907
Test: atest net_test_stack_btm
Tag: #security
Ignore-AOSP-First: security
Merged-In: I4aec266e09e33e8a19a9e33715fdb7ed7f4d4f58
Change-Id: I4aec266e09e33e8a19a9e33715fdb7ed7f4d4f58
parent ecd5a3e8

system/stack/btm/btm_ble_privacy.cc

+6 −0
Original line number Diff line number Diff line
@@ -268,6 +268,12 @@ void btm_ble_clear_resolving_list_complete(uint8_t* p, uint16_t evt_len) { 
 ******************************************************************************/

void btm_ble_add_resolving_list_entry_complete(uint8_t* p, uint16_t evt_len) {

  uint8_t status;



  if (evt_len < 1) {

    BTM_TRACE_ERROR("malformatted event packet: containing zero bytes");

    return;

  }



  STREAM_TO_UINT8(status, p);



  BTM_TRACE_DEBUG("%s status = %d", __func__, status);