Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8675fe9b authored by William Escande's avatar William Escande Committed by Automerger Merge Worker
Browse files

Merge "Fix out of bond write in gatt_db" into tm-dev am: 58920507 

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/17776270



Change-Id: If7f936f066fcddf90071ee56e2295bec9564af2e
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 2131f840 58920507

system/stack/gatt/gatt_db.cc

+8 −2
Original line number Diff line number Diff line
@@ -22,6 +22,8 @@ 
 *

 ******************************************************************************/



#include <base/logging.h>

#include <log/log.h>

#include <stdio.h>

#include <string.h>
@@ -37,8 +39,6 @@ 
#include "stack/include/bt_hdr.h"

#include "types/bluetooth/uuid.h"



#include <base/logging.h>



using base::StringPrintf;

using bluetooth::Uuid;
@@ -237,6 +237,12 @@ static tGATT_STATUS read_attr_value(tGATT_ATTR& attr16, uint16_t offset, 
    uint16_t char_ext_prop =

        attr16.p_value ? attr16.p_value->char_ext_prop : 0x0000;

    *p_len = 2;



    if (mtu < *p_len) {

      android_errorWriteWithInfoLog(0x534e4554, "228078096", -1, NULL, 0);

      return GATT_NO_RESOURCES;

    }



    UINT16_TO_STREAM(p, char_ext_prop);

    *p_data = p;

    return GATT_SUCCESS;