diff options
author | TreeHugger Robot <treehugger-gerrit@google.com> | 2021-12-21 20:14:45 +0000 |
---|---|---|
committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | 2021-12-21 20:14:45 +0000 |
commit | d30055c8d941e1bf053e1d6658aae19734809c8c (patch) | |
tree | 8269c28bd85f30cc17767771215683359257d340 | |
parent | fb39af61b7ef25981ab139b9340c2f42528bca19 (diff) | |
parent | fea928da40dcb06eead53c33c084df4896cf982f (diff) | |
download | bt-d30055c8d941e1bf053e1d6658aae19734809c8c.tar.gz |
Merge "Handle bogus multi value packet lengths" into sc-dev am: fea928da40
Original change: https://googleplex-android-review.googlesource.com/c/platform/system/bt/+/16424061
Change-Id: I797b32edd286c1e8b1470007884325d28f36a1f3
-rw-r--r-- | stack/gatt/gatt_cl.cc | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/stack/gatt/gatt_cl.cc b/stack/gatt/gatt_cl.cc index 8c3567d7a..cb5c13877 100644 --- a/stack/gatt/gatt_cl.cc +++ b/stack/gatt/gatt_cl.cc @@ -745,7 +745,7 @@ void gatt_process_notification(tGATT_TCB& tcb, uint16_t cid, uint8_t op_code, rem_len -= 4; // Make sure we don't read past the remaining data even if the length says // we can Also need to watch comparing the int16_t with the uint16_t - value.len = std::min(rem_len, (int16_t)value.len); + value.len = std::min((uint16_t)rem_len, value.len); STREAM_TO_ARRAY(value.value, p, value.len); // Accounting rem_len -= value.len; |