summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJakub Pawlowski <jpawlowski@google.com>2018-05-10 07:16:13 (GMT)
committerTim Schumacher <timschumi@gmx.de>2018-07-16 18:36:31 (GMT)
commit0d8a3f997c89787655a28cbca1588f7eaeafc824 (patch)
tree58876d6fc20b58ba1f2a00ce426bf6f810c0b8b4
parent21ad8c5950d2f2a8583bef3f7dfff258dbdb9b7d (diff)
downloadandroid_packages_apps_Bluetooth-0d8a3f997c89787655a28cbca1588f7eaeafc824.zip
android_packages_apps_Bluetooth-0d8a3f997c89787655a28cbca1588f7eaeafc824.tar.gz
android_packages_apps_Bluetooth-0d8a3f997c89787655a28cbca1588f7eaeafc824.tar.bz2
Make sure server response doesn't exceed maximum allowable lengthHEADreplicant-6.0-0004-rc1cm-13.0
Bug: 78787521 Test: try sending response bigger than BTGATT_MAX_ATTR_LEN Change-Id: I51b12483cced7e4c0d967acf5bb42559ef169fe7 Merged-In: I51b12483cced7e4c0d967acf5bb42559ef169fe7 (cherry picked from commit 0f34ae9398ed017465c0cac7387be9e6951c07be) (cherry picked from commit c2813a2b6e6dda20e9a25947a4cf5adf6a4f4132)
-rw-r--r--jni/com_android_bluetooth_gatt.cpp8
1 files changed, 7 insertions, 1 deletions
diff --git a/jni/com_android_bluetooth_gatt.cpp b/jni/com_android_bluetooth_gatt.cpp
index d11623a..0a09de4 100644
--- a/jni/com_android_bluetooth_gatt.cpp
+++ b/jni/com_android_bluetooth_gatt.cpp
@@ -1770,7 +1770,13 @@ static void gattServerSendResponseNative (JNIEnv *env, jobject object,
if (val != NULL)
{
- response.attr_value.len = (uint16_t) env->GetArrayLength(val);
+ if (env->GetArrayLength(val) < BTGATT_MAX_ATTR_LEN) {
+ response.attr_value.len = (uint16_t)env->GetArrayLength(val);
+ } else {
+ android_errorWriteLog(0x534e4554, "78787521");
+ response.attr_value.len = BTGATT_MAX_ATTR_LEN;
+ }
+
jbyte* array = env->GetByteArrayElements(val, 0);
for (int i = 0; i != response.attr_value.len; ++i)