Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ab55e0f8 authored by Hansong Zhang's avatar Hansong Zhang
Browse files

Check GATT notification len 

Bug: 123584306
Test: POC
Change-Id: I082b1dc015306980f6e55262b2b58d7140e89bea
parent 7f8579a7

system/stack/gatt/gatt_cl.cc

+4 −0
Original line number Diff line number Diff line
@@ -627,6 +627,10 @@ void gatt_process_notification(tGATT_TCB& tcb, uint8_t op_code, uint16_t len, 
  memset(&value, 0, sizeof(value));

  STREAM_TO_UINT16(value.handle, p);

  value.len = len - 2;

  if (value.len > GATT_MAX_ATTR_LEN) {

    LOG(ERROR) << "value.len larger than GATT_MAX_ATTR_LEN, discard";

    return;

  }

  memcpy(value.value, p, value.len);



  if (!GATT_HANDLE_IS_VALID(value.handle)) {