system/bt
Révision | 88c41287df4418e9ffb3736a8f370665598ca479 (tree) |
---|---|
l'heure | 2018-11-27 02:19:53 |
Auteur | Myles Watson <mylesgw@goog...> |
Commiter | android-build-team Robot |
DO NOT MERGE: HH: Check parameter length in bta_hh_ctrl_dat_act
Bug: 116108738
Test: send a malformed GET_IDLE command with no parameters
Change-Id: Ic57e748a06ea6d4fc16868310d3423ee71a7ac8c
(cherry picked from commit ff8a52d8fefed1ba38f424b1db48a81d46cb7226)
@@ -26,6 +26,7 @@ | ||
26 | 26 | |
27 | 27 | #if (BTA_HH_INCLUDED == TRUE) |
28 | 28 | |
29 | +#include <log/log.h> | |
29 | 30 | #include <string.h> |
30 | 31 | |
31 | 32 | #include "bta_hh_co.h" |
@@ -701,6 +702,12 @@ void bta_hh_ctrl_dat_act(tBTA_HH_DEV_CB* p_cb, tBTA_HH_DATA* p_data) { | ||
701 | 702 | APPL_TRACE_DEBUG("Ctrl DATA received w4: event[%s]", |
702 | 703 | bta_hh_get_w4_event(p_cb->w4_evt)); |
703 | 704 | #endif |
705 | + if (pdata->len == 0) { | |
706 | + android_errorWriteLog(0x534e4554, "116108738"); | |
707 | + p_cb->w4_evt = 0; | |
708 | + osi_free_and_reset((void**)&pdata); | |
709 | + return; | |
710 | + } | |
704 | 711 | hs_data.status = BTA_HH_OK; |
705 | 712 | hs_data.handle = p_cb->hid_handle; |
706 | 713 |