Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 769e66b6 authored by Himanshu Rawat's avatar Himanshu Rawat Committed by Automerger Merge Worker
Browse files

Merge "Out of bound access if the handle or transport type is wrong" into main... 

Merge "Out of bound access if the handle or transport type is wrong" into main am: fca6e070 am: 41a43e35 am: 9eba22c9 am: cd4ffc90

Original change: https://android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/2660938



Change-Id: Ibc206d4a9d1262522d836a047353e0acc9a9cc30
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents c0ebab93 cd4ffc90

system/bta/hh/bta_hh_utils.cc

+12 −5
Original line number Diff line number Diff line
@@ -117,13 +117,20 @@ tBTA_HH_DEV_CB* bta_hh_get_cb(const RawAddress& bda) { 
void bta_hh_clean_up_kdev(tBTA_HH_DEV_CB* p_cb) {

  uint8_t index;



  if (p_cb->hid_handle != BTA_HH_INVALID_HANDLE) {

    if (p_cb->is_le_device)

      bta_hh_cb.le_cb_index[BTA_HH_GET_LE_CB_IDX(p_cb->hid_handle)] =

          BTA_HH_IDX_INVALID;

    else

  if (p_cb->is_le_device) {

    uint8_t le_hid_handle = BTA_HH_GET_LE_CB_IDX(p_cb->hid_handle);

    if (le_hid_handle >= BTA_HH_LE_MAX_KNOWN) {

      LOG_WARN("Invalid LE hid_handle %d", p_cb->hid_handle);

    } else {

      bta_hh_cb.le_cb_index[le_hid_handle] = BTA_HH_IDX_INVALID;

    }

  } else {

    if (p_cb->hid_handle >= BTA_HH_MAX_KNOWN) {

      LOG_WARN("Invalid hid_handle %d", p_cb->hid_handle);

    } else {

      bta_hh_cb.cb_index[p_cb->hid_handle] = BTA_HH_IDX_INVALID;

    }

  }



  /* reset device control block */

  index = p_cb->index; /* Preserve index for this control block */