Merge "adbd: Fix check against valid payload size" into rvc-qpr-dev (f11b01fc) · Commits · e / os / android_system_core

adb/daemon/usb.cpp

+1 −2

Original line number	Original line	Diff line number	Diff line
	@@ -584,12 +584,11 @@ struct UsbFfsConnection : public Connection {
	incoming_header_ = msg;		incoming_header_ = msg;
	} else {		} else {
	size_t bytes_left = incoming_header_->data_length - incoming_payload_.size();		size_t bytes_left = incoming_header_->data_length - incoming_payload_.size();
	Block payload = std::move(block->payload);
	if (block->payload.size() > bytes_left) {		if (block->payload.size() > bytes_left) {
	HandleError("received too many bytes while waiting for payload");		HandleError("received too many bytes while waiting for payload");
	return false;		return false;
	}		}
	incoming_payload_.append(std::move(payload));		incoming_payload_.append(std::move(block->payload));
	}		}

	if (incoming_header_->data_length == incoming_payload_.size()) {		if (incoming_header_->data_length == incoming_payload_.size()) {