Bluetooth: Check the number of file descriptors

Opening the serial port(s) returns -1 when it fails, check
that the number of file descriptors is greater than 0 and
less than the size of the array.

Test: VtsHalBluetoothV1_0TargetTest, Bluetooth start/stop
Bug: 64420262
Change-Id: Icbffa5bd8c02030e389bac03aa5e1e78cc3c6057
(cherry picked from commit 89316af23eb7aa300015a3d80bc97891cfe6031e)

diff --git a/bluetooth/1.0/default/vendor_interface.cc b/bluetooth/1.0/default/vendor_interface.cc
index ffc283e..15b6c74 100644 (file)
--- a/bluetooth/1.0/default/vendor_interface.cc
+++ b/bluetooth/1.0/default/vendor_interface.cc
@@ -226,6 +226,11 @@ bool VendorInterface::Open(InitializeCompleteCallback initialize_complete_cb,
   int fd_list[CH_MAX] = {0};
   int fd_count = lib_interface_->op(BT_VND_OP_USERIAL_OPEN, &fd_list);
 
+  if (fd_count < 1 || fd_count > CH_MAX - 1) {
+    ALOGE("%s: fd_count %d is invalid!", __func__, fd_count);
+    return false;
+  }
+
   for (int i = 0; i < fd_count; i++) {
     if (fd_list[i] == INVALID_FD) {
       ALOGE("%s: fd %d is invalid!", __func__, fd_list[i]);