Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c9985e64 authored by Richard Smith's avatar Richard Smith Committed by android-build-team Robot
Browse files

Fix memory overflow. 

Bug: 180939982
Merged-In: I1be3b836e09901c9cc614b02e21ae41b9a1ebfac
Change-Id: I1be3b836e09901c9cc614b02e21ae41b9a1ebfac
(cherry picked from commit 8d9eb989)
parent 33ddf86e

system/stack/btm/btm_acl.cc

+2 −2
Original line number Original line Diff line number Diff line
@@ -1613,7 +1613,7 @@ bool BTM_TryAllocateSCN(uint8_t scn) { 
  /* Make sure we don't exceed max port range.

  /* Make sure we don't exceed max port range.

   * Stack reserves scn 1 for HFP, HSP we still do the correct way.

   * Stack reserves scn 1 for HFP, HSP we still do the correct way.

   */

   */

  if ((scn >= BTM_MAX_SCN) || (scn == 1)) return false;

  if ((scn >= BTM_MAX_SCN) || (scn == 1) || (scn == 0)) return false;





  /* check if this port is available */

  /* check if this port is available */

  if (!btm_cb.btm_scn[scn - 1]) {

  if (!btm_cb.btm_scn[scn - 1]) {
@@ -1635,7 +1635,7 @@ bool BTM_TryAllocateSCN(uint8_t scn) { 
 ******************************************************************************/

 ******************************************************************************/

bool BTM_FreeSCN(uint8_t scn) {

bool BTM_FreeSCN(uint8_t scn) {

  BTM_TRACE_DEBUG("BTM_FreeSCN ");

  BTM_TRACE_DEBUG("BTM_FreeSCN ");

  if (scn <= BTM_MAX_SCN) {

  if (scn <= BTM_MAX_SCN && scn > 0) {

    btm_cb.btm_scn[scn - 1] = false;

    btm_cb.btm_scn[scn - 1] = false;

    return (true);

    return (true);

  } else {

  } else {