Merge SQ1A.220205.002
Bug: 213904741
Merged-In: I224eb0018f557ca82d092a2ca9b2f29f5e68b39b
Change-Id: I8935b917776490c90a9460485cb3c7267f94eb05
diff --git a/src/gki/common/gki_buffer.cc b/src/gki/common/gki_buffer.cc
index 1aeb3ae..858fe90 100644
--- a/src/gki/common/gki_buffer.cc
+++ b/src/gki/common/gki_buffer.cc
@@ -17,6 +17,7 @@
******************************************************************************/
#include <android-base/stringprintf.h>
#include <base/logging.h>
+#include <log/log.h>
#include "gki_int.h"
#if (GKI_NUM_TOTAL_BUF_POOLS > 16)
@@ -258,8 +259,9 @@
FREE_QUEUE_T* Q;
#if defined(DYN_ALLOC) || defined(FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION)
- if (size == 0) {
- LOG(ERROR) << StringPrintf("getbuf: Size is zero");
+ if (size == 0 || size > (USHRT_MAX - 3)) {
+ LOG(ERROR) << StringPrintf("getbuf: Requested size(%d) is invalid", size);
+ android_errorWriteLog(0x534e4554, "205729183");
#ifndef DYN_ALLOC
abort();
#else
