diff options
| author | TreeHugger Robot <treehugger-gerrit@google.com> | 2021-12-21 19:58:32 +0000 |
|---|---|---|
| committer | Android (Google) Code Review <android-gerrit@google.com> | 2021-12-21 19:58:32 +0000 |
| commit | fea928da40dcb06eead53c33c084df4896cf982f (patch) | |
| tree | 8269c28bd85f30cc17767771215683359257d340 | |
| parent | 4daa7c3802825638ab2b8dcbf7df334188d5f191 (diff) | |
| parent | 97e84ea15a31d8df49003b19ac3ef5cd52ea95f5 (diff) | |
| download | bt-fea928da40dcb06eead53c33c084df4896cf982f.tar.gz | |
Merge "Handle bogus multi value packet lengths" into sc-dev
| -rw-r--r-- | stack/gatt/gatt_cl.cc | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/stack/gatt/gatt_cl.cc b/stack/gatt/gatt_cl.cc index 8c3567d7a..cb5c13877 100644 --- a/stack/gatt/gatt_cl.cc +++ b/stack/gatt/gatt_cl.cc @@ -745,7 +745,7 @@ void gatt_process_notification(tGATT_TCB& tcb, uint16_t cid, uint8_t op_code, rem_len -= 4; // Make sure we don't read past the remaining data even if the length says // we can Also need to watch comparing the int16_t with the uint16_t - value.len = std::min(rem_len, (int16_t)value.len); + value.len = std::min((uint16_t)rem_len, value.len); STREAM_TO_ARRAY(value.value, p, value.len); // Accounting rem_len -= value.len; |