tree 7e4acca28c3dc9fe5fe350a108282c573579adc4
parent 37bb6d6ebb03d2df8ef3ccb0119be1f04ded7eb1
author Brian Delwiche <delwiche@google.com> 1681254345 +0000
committer Android Build Coastguard Worker <android-build-coastguard-worker@google.com> 1693570017 +0000

Fix UAF in gatt_cl.cc

gatt_cl.cc accesses a header field after the buffer holding it may have
been freed.

Track the relevant state as a local variable instead.

Bug: 274617156
Test: atest: bluetooth, validated against fuzzer
Tag: #security
Ignore-AOSP-First: Security
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:cbaa83627b328eee8f2e26188909a5ebfb0388d5)
Merged-In: I085ecfa1a9ba098ecbfecbd3cb3e263ae13f9724
Change-Id: I085ecfa1a9ba098ecbfecbd3cb3e263ae13f9724