Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b2754382 authored by Hui Peng's avatar Hui Peng Committed by Automerger Merge Worker
Browse files

Merge "Fix an OOB bug in bta_gattc_read_multi" into udc-mainline-prod am: 08a8e84a 

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/24517547



Change-Id: I2699c1fe7425b50df8a04c9e625e96160bc2e121
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents a96e810b 08a8e84a

system/bta/gatt/bta_gattc_act.cc

+5 −0
Original line number Diff line number Diff line
@@ -1009,6 +1009,11 @@ void bta_gattc_read_multi(tBTA_GATTC_CLCB* p_clcb, 
                          const tBTA_GATTC_DATA* p_data) {

  if (bta_gattc_enqueue(p_clcb, p_data) == ENQUEUED_FOR_LATER) return;



  if (p_data->api_read_multi.num_attr > GATT_MAX_READ_MULTI_HANDLES) {

    LOG(ERROR) << "api_read_multi.num_attr > GATT_MAX_READ_MULTI_HANDLES";

    return;

  }



  tGATT_READ_PARAM read_param;

  memset(&read_param, 0, sizeof(tGATT_READ_PARAM));