Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9eba22c9 authored by Himanshu Rawat's avatar Himanshu Rawat Committed by Automerger Merge Worker
Browse files

Merge "Out of bound access if the handle or transport type is wrong" into main... 

Merge "Out of bound access if the handle or transport type is wrong" into main am: fca6e070 am: 41a43e35

Original change: https://android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/2660938



Change-Id: Iae2e20bd6be4f3121a09e1ddae79fd8c93f9bb3b
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 19874782 41a43e35

system/bta/hh/bta_hh_utils.cc

+12 −5
Original line number Diff line number Diff line
@@ -117,13 +117,20 @@ tBTA_HH_DEV_CB* bta_hh_get_cb(const RawAddress& bda) { 
void bta_hh_clean_up_kdev(tBTA_HH_DEV_CB* p_cb) {

  uint8_t index;



  if (p_cb->hid_handle != BTA_HH_INVALID_HANDLE) {

    if (p_cb->is_le_device)

      bta_hh_cb.le_cb_index[BTA_HH_GET_LE_CB_IDX(p_cb->hid_handle)] =

          BTA_HH_IDX_INVALID;

    else

  if (p_cb->is_le_device) {

    uint8_t le_hid_handle = BTA_HH_GET_LE_CB_IDX(p_cb->hid_handle);

    if (le_hid_handle >= BTA_HH_LE_MAX_KNOWN) {

      LOG_WARN("Invalid LE hid_handle %d", p_cb->hid_handle);

    } else {

      bta_hh_cb.le_cb_index[le_hid_handle] = BTA_HH_IDX_INVALID;

    }

  } else {

    if (p_cb->hid_handle >= BTA_HH_MAX_KNOWN) {

      LOG_WARN("Invalid hid_handle %d", p_cb->hid_handle);

    } else {

      bta_hh_cb.cb_index[p_cb->hid_handle] = BTA_HH_IDX_INVALID;

    }

  }



  /* reset device control block */

  index = p_cb->index; /* Preserve index for this control block */