commit 27067abebc53720536a5e9fca3d3a56af7933ee7
author Ajay Panicker <apanicke@google.com> Fri May 11 12:03:07 2018 -0700
committer android-build-team Robot <android-build-team-robot@google.com> Fri Jul 20 00:20:06 2018 +0000
tree a8b799438fdbab4e1f93026de3745664b6a0beb5
parent 04c7b0262409337e2c3166bc354162da974d7776

DO NOT MERGE: Check number of attributes before writing to a buffer

Bug: 73824150
Test: Compile
Change-Id: I2a28a503cd74758e707d1e591b55c278d2299f45
(cherry picked from commit f6db54f071f6974e18b10bb0c2cfcf397cd4c980)

btif/src/btif_rc.cc

diff --git a/btif/src/btif_rc.cc b/btif/src/btif_rc.cc
index fc10b8b..edd0730 100644
--- a/btif/src/btif_rc.cc
+++ b/btif/src/btif_rc.cc
@@ -45,6 +45,7 @@
 #include "btif_util.h"
 #include "btu.h"
 #include "device/include/interop.h"
+#include "log/log.h"
 #include "osi/include/list.h"
 #include "osi/include/osi.h"
 #include "osi/include/properties.h"
@@ -3502,6 +3503,12 @@
   RawAddress rc_addr = p_dev->rc_addr;
 
   app_settings.num_attr = p_rsp->num_val;
+
+  if (app_settings.num_attr > BTRC_MAX_APP_SETTINGS) {
+    android_errorWriteLog(0x534e4554, "73824150");
+    app_settings.num_attr = BTRC_MAX_APP_SETTINGS;
+  }
+
   for (xx = 0; xx < app_settings.num_attr; xx++) {
     app_settings.attr_ids[xx] = p_rsp->p_vals[xx].attr_id;
     app_settings.attr_values[xx] = p_rsp->p_vals[xx].attr_val;