From f843ccbf9e3791b426af78389e276c46dbec75e1 Mon Sep 17 00:00:00 2001
From: Jakub Pawlowski <jpawlowski@google.com>
Date: Thu, 29 Nov 2018 18:54:21 +0100
Subject: [PATCH] Bluetooth: Check descriptors size in
 BluetoothHidDeviceAppSdpSettings

Bug: 119819889
Test: compilation
Change-Id: If51d0e2af74d99758f79a603d40cc2f5c84e4dde
Merged-In: If51d0e2af74d99758f79a603d40cc2f5c84e4dde
---
 .../java/android/bluetooth/BluetoothHidDeviceAppSdpSettings.java | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/core/java/android/bluetooth/BluetoothHidDeviceAppSdpSettings.java b/core/java/android/bluetooth/BluetoothHidDeviceAppSdpSettings.java
index f9a224581953..5061fa0b3b6a 100644
--- a/core/java/android/bluetooth/BluetoothHidDeviceAppSdpSettings.java
+++ b/core/java/android/bluetooth/BluetoothHidDeviceAppSdpSettings.java
@@ -18,12 +18,15 @@ package android.bluetooth;
 
 import android.os.Parcel;
 import android.os.Parcelable;
+import android.util.EventLog;
 
 import java.util.Random;
 
 /** @hide */
 public final class BluetoothHidDeviceAppSdpSettings implements Parcelable {
 
+    private static final int MAX_DESCRIPTOR_SIZE = 2048;
+
     final public String name;
     final public String description;
     final public String provider;
@@ -36,6 +39,12 @@ public final class BluetoothHidDeviceAppSdpSettings implements Parcelable {
         this.description = description;
         this.provider = provider;
         this.subclass = subclass;
+
+        if (descriptors == null || descriptors.length > MAX_DESCRIPTOR_SIZE) {
+            EventLog.writeEvent(0x534e4554, "119819889", -1, "");
+            throw new IllegalArgumentException("descriptors must be not null and shorter than "
+                    + MAX_DESCRIPTOR_SIZE);
+        }
         this.descriptors = descriptors.clone();
     }
 
-- 
2.11.0