commit 5f222ea7935df01d4cea53f1a08591016b12daf9
author Marie Janssen <jamuraa@google.com> Thu May 12 15:30:16 2016 -0700
committer The Android Automerger <android-build@google.com> Fri May 27 10:29:38 2016 -0700
tree 750e9e1772c41aa6b849c0bde063efb1e3ba9b3a
parent ac1e36603b17920bc1960d8f064c05cc9009f3e4

DO NOT MERGE btif: check overflow on create_pbuf size

Bug: 27930580
Change-Id: Ieb1f23f9a8a937b21f7c5eca92da3b0b821400e6

btif/src/btif_hh.c

diff --git a/btif/src/btif_hh.c b/btif/src/btif_hh.c
index 633975d..8b977ae 100644
--- a/btif/src/btif_hh.c
+++ b/btif/src/btif_hh.c
@@ -33,6 +33,8 @@
 
 #define LOG_TAG "bt_btif_hh"
 
+#include <cutils/log.h>
+
 #include "bta_api.h"
 #include "bta_hh_api.h"
 #include "btif_storage.h"
@@ -254,7 +256,12 @@
 *******************************************************************************/
 static BT_HDR *create_pbuf(UINT16 len, UINT8 *data)
 {
-    BT_HDR* p_buf = GKI_getbuf((UINT16) (len + BTA_HH_MIN_OFFSET + sizeof(BT_HDR)));
+    UINT16 buflen = (UINT16) (len + BTA_HH_MIN_OFFSET + sizeof(BT_HDR));
+    if (buflen < len) {
+      android_errorWriteWithInfoLog(0x534e4554, "28672558", -1, NULL, 0);
+      return NULL;
+    }
+    BT_HDR* p_buf = GKI_getbuf(buflen);
 
     if (p_buf) {
         UINT8* pbuf_data;