OSDN Git Service
(root)
/
android-x86
/
system-bt.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
DO NOT MERGE: HH: Check parameter length in bta_hh_ctrl_dat_act
[android-x86/system-bt.git]
/
bta
/
hh
/
bta_hh_act.c
diff --git
a/bta/hh/bta_hh_act.c
b/bta/hh/bta_hh_act.c
index
f799e67
..
7d0e5bd
100644
(file)
--- a/
bta/hh/bta_hh_act.c
+++ b/
bta/hh/bta_hh_act.c
@@
-26,6
+26,7
@@
#if defined(BTA_HH_INCLUDED) && (BTA_HH_INCLUDED == TRUE)
#if defined(BTA_HH_INCLUDED) && (BTA_HH_INCLUDED == TRUE)
+#include <log/log.h>
#include <string.h>
#include "bta_sys.h"
#include <string.h>
#include "bta_sys.h"
@@
-764,6
+765,12
@@
void bta_hh_ctrl_dat_act(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA * p_data)
APPL_TRACE_DEBUG("Ctrl DATA received w4: event[%s]",
bta_hh_get_w4_event(p_cb->w4_evt));
#endif
APPL_TRACE_DEBUG("Ctrl DATA received w4: event[%s]",
bta_hh_get_w4_event(p_cb->w4_evt));
#endif
+ if (pdata->len == 0) {
+ android_errorWriteLog(0x534e4554, "116108738");
+ p_cb->w4_evt = 0;
+ osi_free_and_reset((void**)&pdata);
+ return;
+ }
hs_data.status = BTA_HH_OK;
hs_data.handle = p_cb->hid_handle;
hs_data.status = BTA_HH_OK;
hs_data.handle = p_cb->hid_handle;