commit b5dee1bafd5648fd9210b4cba5e23b0665f9add5
author Jakub Pawlowski <jpawlowski@google.com> Thu Nov 29 18:54:21 2018 +0100
committer android-build-team Robot <android-build-team-robot@google.com> Wed Dec 05 05:14:10 2018 +0000
tree 34a2d301ba6d8683436a6ce04d6751fa1cf3b94d
parent 5239804b28b3e49fdea54fc73e431f262c1cf727

Bluetooth: Check descriptors size in BluetoothHidDeviceAppSdpSettings

Bug: 119819889
Test: compilation
Change-Id: If51d0e2af74d99758f79a603d40cc2f5c84e4dde
(cherry picked from commit 63519217e8c0682369b5b3dc11417f79b3b48b7e)

core/java/android/bluetooth/BluetoothHidDeviceAppSdpSettings.java

diff --git a/core/java/android/bluetooth/BluetoothHidDeviceAppSdpSettings.java b/core/java/android/bluetooth/BluetoothHidDeviceAppSdpSettings.java
index 237082e..2f0b44f 100644
--- a/core/java/android/bluetooth/BluetoothHidDeviceAppSdpSettings.java
+++ b/core/java/android/bluetooth/BluetoothHidDeviceAppSdpSettings.java
@@ -18,6 +18,7 @@
 
 import android.os.Parcel;
 import android.os.Parcelable;
+import android.util.EventLog;
 
 
 /**
@@ -30,6 +31,8 @@
  */
 public final class BluetoothHidDeviceAppSdpSettings implements Parcelable {
 
+    private static final int MAX_DESCRIPTOR_SIZE = 2048;
+
     private final String mName;
     private final String mDescription;
     private final String mProvider;
@@ -55,6 +58,12 @@
         mDescription = description;
         mProvider = provider;
         mSubclass = subclass;
+
+        if (descriptors == null || descriptors.length > MAX_DESCRIPTOR_SIZE) {
+            EventLog.writeEvent(0x534e4554, "119819889", -1, "");
+            throw new IllegalArgumentException("descriptors must be not null and shorter than "
+                    + MAX_DESCRIPTOR_SIZE);
+        }
         mDescriptors = descriptors.clone();
     }