summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--jni/com_android_bluetooth_gatt.cpp8
1 files changed, 7 insertions, 1 deletions
diff --git a/jni/com_android_bluetooth_gatt.cpp b/jni/com_android_bluetooth_gatt.cpp
index d11623a59..0a09de4ef 100644
--- a/jni/com_android_bluetooth_gatt.cpp
+++ b/jni/com_android_bluetooth_gatt.cpp
@@ -1770,7 +1770,13 @@ static void gattServerSendResponseNative (JNIEnv *env, jobject object,
if (val != NULL)
{
- response.attr_value.len = (uint16_t) env->GetArrayLength(val);
+ if (env->GetArrayLength(val) < BTGATT_MAX_ATTR_LEN) {
+ response.attr_value.len = (uint16_t)env->GetArrayLength(val);
+ } else {
+ android_errorWriteLog(0x534e4554, "78787521");
+ response.attr_value.len = BTGATT_MAX_ATTR_LEN;
+ }
+
jbyte* array = env->GetByteArrayElements(val, 0);
for (int i = 0; i != response.attr_value.len; ++i)