Check GATT notification len

Bug: 123584306
Test: POC
Change-Id: I082b1dc015306980f6e55262b2b58d7140e89bea

diff --git a/stack/gatt/gatt_cl.cc b/stack/gatt/gatt_cl.cc
index 2650a30..27a4f4f 100644 (file)
--- a/stack/gatt/gatt_cl.cc
+++ b/stack/gatt/gatt_cl.cc
@@ -627,6 +627,10 @@ void gatt_process_notification(tGATT_TCB& tcb, uint8_t op_code, uint16_t len,
   memset(&value, 0, sizeof(value));
   STREAM_TO_UINT16(value.handle, p);
   value.len = len - 2;
+  if (value.len > GATT_MAX_ATTR_LEN) {
+    LOG(ERROR) << "value.len larger than GATT_MAX_ATTR_LEN, discard";
+    return;
+  }
   memcpy(value.value, p, value.len);
 
   if (!GATT_HANDLE_IS_VALID(value.handle)) {