Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 759c6733 authored by Timothy Yiu's avatar Timothy Yiu Committed by Automerger Merge Worker
Browse files

Merge "Fix gatt_end_operation buffer overflow" into tm-dev am: e8779817 am: 01d3e82a 

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/22316109



Change-Id: I4853e4bd4ca025f31ca8a59c9708ae280b451a2e
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 3e516f21 01d3e82a

system/stack/gatt/gatt_utils.cc

+7 −0
Original line number Diff line number Diff line
@@ -1591,6 +1591,13 @@ void gatt_end_operation(tGATT_CLCB* p_clcb, tGATT_STATUS status, void* p_data) { 
      cb_data.att_value.handle = p_clcb->s_handle;

      cb_data.att_value.len = p_clcb->counter;



      if (cb_data.att_value.len > GATT_MAX_ATTR_LEN) {

        LOG(WARNING) << __func__

                     << StringPrintf(" Large cb_data.att_value, size=%d",

                                     cb_data.att_value.len);

        cb_data.att_value.len = GATT_MAX_ATTR_LEN;

      }



      if (p_data && p_clcb->counter)

        memcpy(cb_data.att_value.value, p_data, cb_data.att_value.len);

    }