Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit acb14e20 authored by Hui Peng's avatar Hui Peng
Browse files

Fix an OOB bug in dis_c_cmpl_cback 

This change can be tested with gatt sanity tests.

Bug: 254839585
Test: m com.android.btservices
Ignore-AOSP-First: security
Tag: #security
Change-Id: Ic2f45486cfff5ddee3a5a0908ab028d464ee80f5
parent 269c90fc

system/stack/srvc/srvc_dis.cc

+8 −1
Original line number Diff line number Diff line
@@ -260,10 +260,17 @@ bool dis_gatt_c_read_dis_req(uint16_t conn_id) { 
 ******************************************************************************/

void dis_c_cmpl_cback(tSRVC_CLCB* p_clcb, tGATTC_OPTYPE op, tGATT_STATUS status,

                      tGATT_CL_COMPLETE* p_data) {

  uint16_t read_type = dis_attr_uuid[dis_cb.dis_read_uuid_idx];

  uint16_t read_type;

  uint8_t *pp = NULL, *p_str;

  uint16_t conn_id = p_clcb->conn_id;



  if (dis_cb.dis_read_uuid_idx >= (sizeof(dis_attr_uuid)/sizeof(dis_attr_uuid[0]))) {

    LOG(ERROR) << "invalid dis_cb.dis_read_uuid_idx";

    return;

  }



  read_type = dis_attr_uuid[dis_cb.dis_read_uuid_idx];



  VLOG(1) << __func__

          << StringPrintf("op_code: 0x%02x  status: 0x%02x read_type: 0x%04x",

                          op, status, read_type);