commit 61bf35430359db138f1913802fcd902a3c3bf1b4
author Jakub Pawlowski <jpawlowski@google.com> Thu May 10 00:16:13 2018 -0700
committer android-build-team Robot <android-build-team-robot@google.com> Mon Jun 11 22:21:57 2018 +0000
tree d3d9d785e5c622a215ccf2b6bbad17f6ef7ac14d
parent 7f7f6608d7513709d1c55d3c25ddbe43687ec06a

Make sure server response doesn't exceed maximum allowable length

Bug: 78787521
Test: try sending response bigger than BTGATT_MAX_ATTR_LEN
Change-Id: I51b12483cced7e4c0d967acf5bb42559ef169fe7
Merged-In: I51b12483cced7e4c0d967acf5bb42559ef169fe7
(cherry picked from commit 0f34ae9398ed017465c0cac7387be9e6951c07be)
(cherry picked from commit c2813a2b6e6dda20e9a25947a4cf5adf6a4f4132)

jni/com_android_bluetooth_gatt.cpp

diff --git a/jni/com_android_bluetooth_gatt.cpp b/jni/com_android_bluetooth_gatt.cpp
index 3bfbcfd..e57a1d0 100644
--- a/jni/com_android_bluetooth_gatt.cpp
+++ b/jni/com_android_bluetooth_gatt.cpp
@@ -1650,7 +1650,13 @@
   response.attr_value.len = 0;
 
   if (val != NULL) {
-    response.attr_value.len = (uint16_t)env->GetArrayLength(val);
+    if (env->GetArrayLength(val) < BTGATT_MAX_ATTR_LEN) {
+      response.attr_value.len = (uint16_t)env->GetArrayLength(val);
+    } else {
+      android_errorWriteLog(0x534e4554, "78787521");
+      response.attr_value.len = BTGATT_MAX_ATTR_LEN;
+    }
+
     jbyte* array = env->GetByteArrayElements(val, 0);
 
     for (int i = 0; i != response.attr_value.len; ++i)