commit 7b296f0909401f1c0d7be1d0a52d41ea6ea6879a
author Myles Watson <mylesgw@google.com> Thu Aug 10 00:44:32 2017 +0000
committer android-build-merger <android-build-merger@google.com> Thu Aug 10 00:44:32 2017 +0000
tree d1a291dfd63d58803bde1f59108240be4de0d3c0
parent 5241db9e601de2d960a391430aa5a2f4912d6e9b
parent b58a5a0b6abff6360147de36e7c395c6f2600ab9

Merge "Bluetooth: Check the number of file descriptors" am: 6b75bccdce
am: b58a5a0b6a

Change-Id: I1da14cc5cdf595852428e48a6b9585f88c2be362

bluetooth/1.0/default/vendor_interface.cc

diff --git a/bluetooth/1.0/default/vendor_interface.cc b/bluetooth/1.0/default/vendor_interface.cc
index ffc283e..15b6c74 100644
--- a/bluetooth/1.0/default/vendor_interface.cc
+++ b/bluetooth/1.0/default/vendor_interface.cc
@@ -226,6 +226,11 @@
   int fd_list[CH_MAX] = {0};
   int fd_count = lib_interface_->op(BT_VND_OP_USERIAL_OPEN, &fd_list);
 
+  if (fd_count < 1 || fd_count > CH_MAX - 1) {
+    ALOGE("%s: fd_count %d is invalid!", __func__, fd_count);
+    return false;
+  }
+
   for (int i = 0; i < fd_count; i++) {
     if (fd_list[i] == INVALID_FD) {
       ALOGE("%s: fd %d is invalid!", __func__, fd_list[i]);