commit 6b75bccdce8411976553749ed31955eadda70cf7
author Treehugger Robot <treehugger-gerrit@google.com> Thu Aug 10 00:30:44 2017 +0000
committer Gerrit Code Review <noreply-gerritcodereview@google.com> Thu Aug 10 00:30:44 2017 +0000
tree 29cb03dc688c3eedaafbd57db912e699b0f5fe2c
parent 7b351292feb29797c41eb806e4601196c3489132
parent ec1eda69b6e41cc7d5d2a520c87602e4dcd8353d

Merge "Bluetooth: Check the number of file descriptors"

bluetooth/1.0/default/vendor_interface.cc

diff --git a/bluetooth/1.0/default/vendor_interface.cc b/bluetooth/1.0/default/vendor_interface.cc
index ffc283e..15b6c74 100644
--- a/bluetooth/1.0/default/vendor_interface.cc
+++ b/bluetooth/1.0/default/vendor_interface.cc
@@ -226,6 +226,11 @@
   int fd_list[CH_MAX] = {0};
   int fd_count = lib_interface_->op(BT_VND_OP_USERIAL_OPEN, &fd_list);
 
+  if (fd_count < 1 || fd_count > CH_MAX - 1) {
+    ALOGE("%s: fd_count %d is invalid!", __func__, fd_count);
+    return false;
+  }
+
   for (int i = 0; i < fd_count; i++) {
     if (fd_list[i] == INVALID_FD) {
       ALOGE("%s: fd %d is invalid!", __func__, fd_list[i]);