Android-x86
Forksystem/bt
| Revisión | 88c41287df4418e9ffb3736a8f370665598ca479 (tree) |
|---|---|
| Tiempo | 2018-11-27 02:19:53 |
| Autor | Myles Watson <mylesgw@goog...> |
| Commiter | android-build-team Robot |
DO NOT MERGE: HH: Check parameter length in bta_hh_ctrl_dat_act
Bug: 116108738
Test: send a malformed GET_IDLE command with no parameters
Change-Id: Ic57e748a06ea6d4fc16868310d3423ee71a7ac8c
(cherry picked from commit ff8a52d8fefed1ba38f424b1db48a81d46cb7226)
bta/hh/bta_hh_act.cc (diff)| @@ -26,6 +26,7 @@ | ||
| 26 | 26 | |
| 27 | 27 | #if (BTA_HH_INCLUDED == TRUE) |
| 28 | 28 | |
| 29 | +#include <log/log.h> | |
| 29 | 30 | #include <string.h> |
| 30 | 31 | |
| 31 | 32 | #include "bta_hh_co.h" |
| @@ -701,6 +702,12 @@ void bta_hh_ctrl_dat_act(tBTA_HH_DEV_CB* p_cb, tBTA_HH_DATA* p_data) { | ||
| 701 | 702 | APPL_TRACE_DEBUG("Ctrl DATA received w4: event[%s]", |
| 702 | 703 | bta_hh_get_w4_event(p_cb->w4_evt)); |
| 703 | 704 | #endif |
| 705 | + if (pdata->len == 0) { | |
| 706 | + android_errorWriteLog(0x534e4554, "116108738"); | |
| 707 | + p_cb->w4_evt = 0; | |
| 708 | + osi_free_and_reset((void**)&pdata); | |
| 709 | + return; | |
| 710 | + } | |
| 704 | 711 | hs_data.status = BTA_HH_OK; |
| 705 | 712 | hs_data.handle = p_cb->hid_handle; |
| 706 | 713 |
