Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f1227636 authored by Hui Peng's avatar Hui Peng Committed by Automerger Merge Worker
Browse files

Merge "Fix an OOB write in BTA_GATTS_HandleValueIndication" into tm-dev am:... 

Merge "Fix an OOB write in BTA_GATTS_HandleValueIndication" into tm-dev am: 45027bbe am: b9524b22

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/20813127



Change-Id: I9134ec223f3195c642f0488f242a2529134914dd
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 8e33203f b9524b22

system/bta/gatt/bta_gatts_api.cc

+6 −0
Original line number Original line Diff line number Diff line
@@ -242,6 +242,12 @@ void BTA_GATTS_StopService(uint16_t service_id) { 
void BTA_GATTS_HandleValueIndication(uint16_t conn_id, uint16_t attr_id,

void BTA_GATTS_HandleValueIndication(uint16_t conn_id, uint16_t attr_id,

                                     std::vector<uint8_t> value,

                                     std::vector<uint8_t> value,

                                     bool need_confirm) {

                                     bool need_confirm) {



  if (value.size() > sizeof(tBTA_GATTS_API_INDICATION::value)) {

    LOG(ERROR) << __func__ << "data to indicate is too long";

    return;

  }



  tBTA_GATTS_API_INDICATION* p_buf =

  tBTA_GATTS_API_INDICATION* p_buf =

      (tBTA_GATTS_API_INDICATION*)osi_calloc(sizeof(tBTA_GATTS_API_INDICATION));

      (tBTA_GATTS_API_INDICATION*)osi_calloc(sizeof(tBTA_GATTS_API_INDICATION));