tree 139958b6506ad1c2958636aaf59841fc5400cd09
parent bbaa19cad3227eb0262beb5555db54902ef17821
author Hemant Gupta <hemantg@codeaurora.org> 1482907247 +0530
committer Myles Watson <mylesgw@google.com> 1510258011 +0000

OBEX : Handle Negative index Exception

Use case:
1. Send file to remote device.
2. Wait for accepting the file transfer on remote device.
   Use Specific remote device(that sends some
     optional headers).

Failure:
No file acceptance popup seen on remote device.

Root cause:
Crash in com.android.bluetooth.

 FATAL EXCEPTION: BtOpp ClientThread
 Process: com.android.bluetooth, PID: 22527
 java.lang.NegativeArraySizeException: -3
 at javax.obex.ObexHelper.updateHeaderSet(ObexHelper.java:216)
 at javax.obex.ClientSession.sendRequest(ClientSession.java:568)
 at javax.obex.ClientSession.connect(ClientSession.java:148)
 at com.android.bluetooth.opp.BluetoothOppObexClientSession$ClientThread.
   connect(BluetoothOppObexClientSession.java:317)
 at com.android.bluetooth.opp.BluetoothOppObexClientSession$ClientThread.
   run(BluetoothOppObexClientSession.java:231)
 am_crash( 1402): [22527,0,com.android.bluetooth,818462277,java.lang.
   NegativeArraySizeException,-3,ObexHelper.java,216]

Fix:
Add length check before allocate memory and break loop if length is less than
expected header length as per OBEX Specification  to prevent crash.

Test: Verified that OPP Tx and Rx works successfully multiple times.

Bug: 35588578
Change-Id: I805e6b1d51f69645d5132c3c18db2e752d04b096