Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cd4ffc90 authored by Himanshu Rawat's avatar Himanshu Rawat Committed by Automerger Merge Worker
Browse files

Merge "Out of bound access if the handle or transport type is wrong" into main... 

Merge "Out of bound access if the handle or transport type is wrong" into main am: fca6e070 am: 41a43e35 am: 9eba22c9

Original change: https://android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/2660938



Change-Id: I833e20f38de4dd0ee972bb609a382e9ff31304d9
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents bc756963 9eba22c9

system/bta/hh/bta_hh_utils.cc

+12 −5
Original line number Diff line number Diff line
@@ -117,13 +117,20 @@ tBTA_HH_DEV_CB* bta_hh_get_cb(const RawAddress& bda) { 
void bta_hh_clean_up_kdev(tBTA_HH_DEV_CB* p_cb) {

  uint8_t index;



  if (p_cb->hid_handle != BTA_HH_INVALID_HANDLE) {

    if (p_cb->is_le_device)

      bta_hh_cb.le_cb_index[BTA_HH_GET_LE_CB_IDX(p_cb->hid_handle)] =

          BTA_HH_IDX_INVALID;

    else

  if (p_cb->is_le_device) {

    uint8_t le_hid_handle = BTA_HH_GET_LE_CB_IDX(p_cb->hid_handle);

    if (le_hid_handle >= BTA_HH_LE_MAX_KNOWN) {

      LOG_WARN("Invalid LE hid_handle %d", p_cb->hid_handle);

    } else {

      bta_hh_cb.le_cb_index[le_hid_handle] = BTA_HH_IDX_INVALID;

    }

  } else {

    if (p_cb->hid_handle >= BTA_HH_MAX_KNOWN) {

      LOG_WARN("Invalid hid_handle %d", p_cb->hid_handle);

    } else {

      bta_hh_cb.cb_index[p_cb->hid_handle] = BTA_HH_IDX_INVALID;

    }

  }



  /* reset device control block */

  index = p_cb->index; /* Preserve index for this control block */