diff options
| author | Hansong Zhang <hsz@google.com> | 2020-02-13 11:40:44 -0800 |
|---|---|---|
| committer | Myles Watson <mylesgw@google.com> | 2020-02-13 22:36:35 +0000 |
| commit | 09e131ba6bc47e964279273e1766dc0489c8e24b (patch) | |
| tree | 0ff609a508166ea3802ac59aac7c65919f7647a3 /service | |
| parent | 77646a623aa46b45bd97058de4c6fc950801e8e3 (diff) | |
| download | bt-09e131ba6bc47e964279273e1766dc0489c8e24b.tar.gz | |
GattServer: Check invalid offset
Test: manual
Bug: 143231677
Change-Id: I0ca22e7c60292d61c758120c1cd67f6e6edd8ae8
Diffstat (limited to 'service')
| -rw-r--r-- | service/gatt_server.cc | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/service/gatt_server.cc b/service/gatt_server.cc index 08c4f83f2..f911f548c 100644 --- a/service/gatt_server.cc +++ b/service/gatt_server.cc @@ -118,6 +118,11 @@ bool GattServer::SendResponse(const std::string& device_address, int request_id, return false; } + if (offset < 0) { + LOG(ERROR) << "Offset is less than 0 offset: " << offset; + return false; + } + if (value.size() + offset > BTGATT_MAX_ATTR_LEN) { LOG(ERROR) << "Value is too large"; return false; |