Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 99c51f9e authored by Brian Delwiche's avatar Brian Delwiche Committed by Automerger Merge Worker
Browse files

Merge "Fix integer overflow in build_read_multi_rsp" into tm-dev am: 0db5f1b1 

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/22726306



Change-Id: If6caa5cc206e615c0cf8f6a1efc819870c1bf3d5
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents b3fd1bd5 0db5f1b1

system/stack/gatt/gatt_sr.cc

+12 −5
Original line number Diff line number Diff line
@@ -142,7 +142,8 @@ void gatt_dequeue_sr_cmd(tGATT_TCB& tcb, uint16_t cid) { 
}



static void build_read_multi_rsp(tGATT_SR_CMD* p_cmd, uint16_t mtu) {

  uint16_t ii, total_len, len;

  uint16_t ii;

  size_t total_len, len;

  uint8_t* p;

  bool is_overflow = false;
@@ -187,7 +188,7 @@ static void build_read_multi_rsp(tGATT_SR_CMD* p_cmd, uint16_t mtu) { 
        len = p_rsp->attr_value.len - (total_len - mtu);

        is_overflow = true;

        VLOG(1) << StringPrintf(

            "multi read overflow available len=%d val_len=%d", len,

            "multi read overflow available len=%zu val_len=%d", len,

            p_rsp->attr_value.len);

      } else {

        len = p_rsp->attr_value.len;
@@ -199,6 +200,8 @@ static void build_read_multi_rsp(tGATT_SR_CMD* p_cmd, uint16_t mtu) { 
      }



      if (p_rsp->attr_value.handle == p_cmd->multi_req.handles[ii]) {

        // check for possible integer overflow

        if (p_buf->len + len <= UINT16_MAX) {

          memcpy(p, p_rsp->attr_value.value, len);

          if (!is_overflow) p += len;

          p_buf->len += len;
@@ -206,6 +209,10 @@ static void build_read_multi_rsp(tGATT_SR_CMD* p_cmd, uint16_t mtu) { 
          p_cmd->status = GATT_NOT_FOUND;

          break;

        }

      } else {

        p_cmd->status = GATT_NOT_FOUND;

        break;

      }



      if (is_overflow) break;