MarcoBuster/Gadgetbridge
1
0
Fork 0
mirror of https://codeberg.org/Freeyourgadget/Gadgetbridge synced 2024-11-29 05:16:51 +01:00
Code Releases Wiki Activity

fixed dangling request and bufferoverflow

Browse Source
This commit is contained in:
Daniel Dakhno 2020-01-09 14:45:24 +01:00
parent 02fb7a0e43
commit adf135ef10
2 changed files with 14 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
app/src/main/java/nodomain/freeyourgadget/gadgetbridge/service/devices/qhybrid/adapter/fossil/FossilWatchAdapter.java
View File

@ -590,6 +590,11 @@ public class FossilWatchAdapter extends WatchAdapter {
log("executing request: " + request.getName());
this.fossilRequest = request;
new TransactionBuilder(request.getClass().getSimpleName()).write(getDeviceSupport().getCharacteristic(request.getRequestUUID()), request.getRequestData()).queue(getDeviceSupport().getQueue());
if(request.isFinished()){
this.fossilRequest = null;
queueNextRequest();
}
}
public void queueWrite(Request request, boolean priorise) {

14
app/src/main/java/nodomain/freeyourgadget/gadgetbridge/service/devices/qhybrid/requests/fossil_hr/music/MusicInfoSetRequest.java
View File

@ -13,8 +13,12 @@ public class MusicInfoSetRequest extends FilePutRequest {
}
private static byte[] createFile(String artist, String album, String title) {
int length = artist.length() + album.length() + title.length()
+ 3 // null terminators
//counting byte array length because of utf chars, they may take up two bytes
int titleLength = title.getBytes().length + 1; // +1 = null terminator
int albumLength = album.getBytes().length + 1;
int artistLength = artist.getBytes().length + 1;
int length = artistLength + albumLength + titleLength
+ 8; // length and header
ByteBuffer buffer = ByteBuffer.allocate(length);
@ -22,9 +26,9 @@ public class MusicInfoSetRequest extends FilePutRequest {
buffer.putShort((short) length);
buffer.put((byte) 0x01); // dunno
buffer.put((byte) (title.length() + 1));
buffer.put((byte) (artist.length() + 1));
buffer.put((byte) (album.length() + 1));
buffer.put((byte) (titleLength));
buffer.put((byte) (artistLength));
buffer.put((byte) (albumLength));
buffer.put((byte) 0x0C); // dunno
buffer.put((byte) 0x00); // dunno