Snap for 4954419 from 476406ec2bf2a1cde4015060f66601288769ca99 to pi-qpr1-releaseandroid-9.0.0_r35android-9.0.0_r34android-9.0.0_r33android-9.0.0_r32android-9.0.0_r31android-9.0.0_r30android-9.0.0_r22android-9.0.0_r21android-9.0.0_r20android-9.0.0_r19android-9.0.0_r16pie-qpr2-releasepie-qpr1-s3-releasepie-qpr1-s2-releasepie-qpr1-s1-releasepie-qpr1-release

Change-Id: I4a8ffcfd1e6cc7cc302fa1c3f41a6910ddb40c92

1 files changed, 11 insertions, 1 deletions

diff --git a/src/transport_tests.cc b/src/transport_tests.cc
index 794135b..b57ccae 100644
--- a/src/transport_tests.cc
+++ b/src/transport_tests.cc
@@ -176,10 +176,20 @@ bool StatusMatches(const transport_status& arg, uint32_t status, uint16_t flags,
   ok &= arg.version == TRANSPORT_V1;
   ok &= arg.flags == flags;
 
+  // Check the status is a valid length
+  if (arg.length < STATUS_MIN_LENGTH || arg.length > STATUS_MAX_LENGTH) {
+    return false;
+  }
+
+  // As of v1, the length shouldn\t be greater than transport_status
+  if (arg.length > sizeof(transport_status)) {
+    return false;
+  }
+
+  // Check the CRCs are valid
   transport_status st = arg;
   st.crc = 0;
   ok &= arg.crc == crc16(&st, st.length);
-
   ok &= arg.reply_crc == crc16(reply, reply_len);
 
   return ok;