Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e8779817 authored by Timothy Yiu's avatar Timothy Yiu Committed by Android (Google) Code Review
Browse files

Merge "Fix gatt_end_operation buffer overflow" into tm-dev

parents 003c3d27 7236e449

system/stack/gatt/gatt_utils.cc

+7 −0
Original line number Diff line number Diff line
@@ -1518,6 +1518,13 @@ void gatt_end_operation(tGATT_CLCB* p_clcb, tGATT_STATUS status, void* p_data) { 
      cb_data.att_value.handle = p_clcb->s_handle;

      cb_data.att_value.len = p_clcb->counter;



      if (cb_data.att_value.len > GATT_MAX_ATTR_LEN) {

        LOG(WARNING) << __func__

                     << StringPrintf(" Large cb_data.att_value, size=%d",

                                     cb_data.att_value.len);

        cb_data.att_value.len = GATT_MAX_ATTR_LEN;

      }



      if (p_data && p_clcb->counter)

        memcpy(cb_data.att_value.value, p_data, cb_data.att_value.len);

    }