Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit df8a21a5 authored by Łukasz Rymanowski's avatar Łukasz Rymanowski Committed by Automerger Merge Worker
Browse files

Merge "gatt: Fix crash if user use invalid attribute len" am: 23cf6d39 am:... 

Merge "gatt: Fix crash if user use invalid attribute len" am: 23cf6d39 am: 6670de5f am: bf05cc40 am: 31cc8593

Original change: https://android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/2387852



Change-Id: I7da96b9960b6308fd85291825bbf5dca2cbfc664
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents c96bec3e 31cc8593

system/bta/gatt/bta_gattc_act.cc

+9 −4
Original line number Diff line number Diff line
@@ -996,11 +996,16 @@ void bta_gattc_write(tBTA_GATTC_CLCB* p_clcb, const tBTA_GATTC_DATA* p_data) { 
  attr.len = p_data->api_write.len;

  attr.auth_req = p_data->api_write.auth_req;



  /* Before coping to the fixed array, make sure it fits. */

  if (attr.len > GATT_MAX_ATTR_LEN) {

    status = GATT_INVALID_ATTR_LEN;

  } else {

    if (p_data->api_write.p_value)

      memcpy(attr.value, p_data->api_write.p_value, p_data->api_write.len);



    status =

        GATTC_Write(p_clcb->bta_conn_id, p_data->api_write.write_type, &attr);

  }



  /* write fail */

  if (status != GATT_SUCCESS) {