Skip to content
Snippets Groups Projects
Commit 2d11abc3 authored by Hui Peng's avatar Hui Peng Committed by Android Build Coastguard Worker
Browse files

Fix an OOB write bug in attp_build_read_by_type_value_cmd

Bug: 297524203
Test: m com.android.btservices
Ignore-AOSP-First: security
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:140c41e3553bc59fe97e3f5ee96c64e2251971e2)
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:e9b40c3dfd81c3fa99b3f115135de7e2c356ece9)
Merged-In: I2a95bbcce9a16ac84dd714eb4561428711a9872e
Change-Id: I2a95bbcce9a16ac84dd714eb4561428711a9872e
parent 67241b75
No related branches found
No related tags found
No related merge requests found
......@@ -165,7 +165,13 @@ static BT_HDR* attp_build_read_by_type_value_cmd(
uint16_t payload_size, tGATT_FIND_TYPE_VALUE* p_value_type) {
uint8_t* p;
uint16_t len = p_value_type->value_len;
BT_HDR* p_buf =
BT_HDR* p_buf = nullptr;
if (payload_size < 5) {
return nullptr;
}
p_buf =
(BT_HDR*)osi_malloc(sizeof(BT_HDR) + payload_size + L2CAP_MIN_OFFSET);
p = (uint8_t*)(p_buf + 1) + L2CAP_MIN_OFFSET;
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment