Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c050b1a9 authored by Ted Wang's avatar Ted Wang
Browse files

Fix OOB in btm_ble_vendor_capability_vsc_cmpl_cback 

Bug: 91544774
Test: maunal
Change-Id: Ibe23668a4079d1cf651c770d6a1129ae2f767c0e
parent 37ac3e45

system/stack/btm/btm_ble_gap.cc

+6 −1
Original line number Diff line number Diff line
@@ -58,7 +58,10 @@ 


#define BTM_EXT_BLE_RMT_NAME_TIMEOUT_MS (30 * 1000)

#define MIN_ADV_LENGTH 2

#define BTM_VSC_CHIP_CAPABILITY_RSP_LEN_L_RELEASE 9

#define BTM_VSC_CHIP_CAPABILITY_RSP_LEN 9

#define BTM_VSC_CHIP_CAPABILITY_RSP_LEN_L_RELEASE \

  BTM_VSC_CHIP_CAPABILITY_RSP_LEN

#define BTM_VSC_CHIP_CAPABILITY_RSP_LEN_M_RELEASE 15



namespace {
@@ -495,6 +498,7 @@ static void btm_ble_vendor_capability_vsc_cmpl_cback( 
    BTM_TRACE_DEBUG("%s: Status = 0x%02x (0 is success)", __func__, status);

    return;

  }

  CHECK(p_vcs_cplt_params->param_len > BTM_VSC_CHIP_CAPABILITY_RSP_LEN);

  STREAM_TO_UINT8(btm_cb.cmn_ble_vsc_cb.adv_inst_max, p);

  STREAM_TO_UINT8(btm_cb.cmn_ble_vsc_cb.rpa_offloading, p);

  STREAM_TO_UINT16(btm_cb.cmn_ble_vsc_cb.tot_scan_results_strg, p);
@@ -512,6 +516,7 @@ static void btm_ble_vendor_capability_vsc_cmpl_cback( 


  if (btm_cb.cmn_ble_vsc_cb.version_supported >=

      BTM_VSC_CHIP_CAPABILITY_M_VERSION) {

    CHECK(p_vcs_cplt_params->param_len >= BTM_VSC_CHIP_CAPABILITY_RSP_LEN_M_RELEASE);

    STREAM_TO_UINT16(btm_cb.cmn_ble_vsc_cb.total_trackable_advertisers, p);

    STREAM_TO_UINT8(btm_cb.cmn_ble_vsc_cb.extended_scan_support, p);

    STREAM_TO_UINT8(btm_cb.cmn_ble_vsc_cb.debug_logging_supported, p);