Commit: c5e276fdf72b104e58ddf80cfa9424012422b95e - system-bt (git)

system/bt

Commit MetaInfo

• Revision: c5e276fdf72b104e58ddf80cfa9424012422b95e (tree)
• Time: 2019-01-18 19:52:46
• Author: Myles Watson <mylesgw@goog...>
• Commiter: Vasyl Gello

Log Message

HH: Check parameter length in bta_hh_ctrl_dat_act

Bug: 116108738
Test: send a malformed GET_IDLE command with no parameters
Change-Id: Ic57e748a06ea6d4fc16868310d3423ee71a7ac8c
(cherry picked from commit b8fbe73f0d32686e8393bfe07a84b6f0e8829caf)

Change Summary

• modified: bta/hh/bta_hh_act.c

Incremental Difference

--- a/bta/hh/bta_hh_act.c
+++ b/bta/hh/bta_hh_act.c
@@ -26,6 +26,7 @@
 
 #if defined(BTA_HH_INCLUDED) && (BTA_HH_INCLUDED == TRUE)
 
+#include <log/log.h>
 #include <string.h>
 
 #include "bta_sys.h"
@@ -777,6 +778,13 @@ void bta_hh_ctrl_dat_act(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA * p_data)
     APPL_TRACE_DEBUG("Ctrl DATA received w4: event[%s]",
                         bta_hh_get_w4_event(p_cb->w4_evt));
 #endif
+    if (pdata->len == 0)
+    {
+        android_errorWriteLog(0x534e4554, "116108738");
+        p_cb->w4_evt = 0;
+        osi_free_and_reset((void**)&pdata);
+        return;
+    }
     hs_data.status  = BTA_HH_OK;
     hs_data.handle  = p_cb->hid_handle;