Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 84e34eb5 authored by Jakub Pawlowski's avatar Jakub Pawlowski
Browse files

Fix potential null dereference after call to read_command_complete_header 

Bug: 180421035
Test: compilation
Change-Id: I3606bb08f514d376087a454c482f28c6e4eadb59
parent e618ab9e

system/hci/src/hci_packet_parser.cc

+21 −15
Original line number Diff line number Diff line
@@ -190,8 +190,9 @@ static void parse_ble_read_resolving_list_size_response( 
    BT_HDR* response, uint8_t* resolving_list_size_ptr) {

  uint8_t* stream = read_command_complete_header(

      response, HCI_BLE_READ_RESOLVING_LIST_SIZE, 1 /* bytes after */);

  if (stream) {

    STREAM_TO_UINT8(*resolving_list_size_ptr, stream);



  }

  buffer_allocator->free(response);

}
@@ -199,8 +200,9 @@ static void parse_ble_read_suggested_default_data_length_response( 
    BT_HDR* response, uint16_t* ble_default_packet_length_ptr) {

  uint8_t* stream = read_command_complete_header(

      response, HCI_BLE_READ_DEFAULT_DATA_LENGTH, 2 /* bytes after */);

  if (stream) {

    STREAM_TO_UINT16(*ble_default_packet_length_ptr, stream);



  }

  buffer_allocator->free(response);

}
@@ -210,11 +212,12 @@ static void parse_ble_read_maximum_data_length_response( 
    uint16_t* ble_supported_max_rx_time) {

  uint8_t* stream = read_command_complete_header(

      response, HCI_BLE_READ_MAXIMUM_DATA_LENGTH, 8 /* bytes after */);

  if (stream) {

    STREAM_TO_UINT16(*ble_supported_max_tx_octets, stream);

    STREAM_TO_UINT16(*ble_supported_max_tx_time, stream);

    STREAM_TO_UINT16(*ble_supported_max_rx_octets, stream);

    STREAM_TO_UINT16(*ble_supported_max_rx_time, stream);



  }

  buffer_allocator->free(response);

}
@@ -223,8 +226,9 @@ static void parse_ble_read_maximum_advertising_data_length( 
  uint8_t* stream = read_command_complete_header(

      response, HCI_LE_READ_MAXIMUM_ADVERTISING_DATA_LENGTH,

      2 /* bytes after */);

  if (stream) {

    STREAM_TO_UINT16(*ble_maximum_advertising_data_length_ptr, stream);



  }

  buffer_allocator->free(response);

}
@@ -233,8 +237,9 @@ static void parse_ble_read_number_of_supported_advertising_sets( 
  uint8_t* stream = read_command_complete_header(

      response, HCI_LE_READ_NUMBER_OF_SUPPORTED_ADVERTISING_SETS,

      1 /* bytes after */);

  if (stream) {

    STREAM_TO_UINT8(*ble_number_of_supported_advertising_sets_ptr, stream);



  }

  buffer_allocator->free(response);

}
@@ -243,8 +248,9 @@ static void parse_ble_read_size_of_advertiser_list( 
  uint8_t* stream = read_command_complete_header(

      response, HCI_BLE_READ_PERIODIC_ADVERTISER_LIST_SIZE,

      1 /* bytes after */);

  if (stream) {

    STREAM_TO_UINT8(*ble_size_of_advertiser_list_ptr, stream);



  }

  buffer_allocator->free(response);

}