diff --git a/adb/adb.cpp b/adb/adb.cpp index c03d7dbbf..484e56165 100644 --- a/adb/adb.cpp +++ b/adb/adb.cpp @@ -857,8 +857,7 @@ int handle_forward_request(const char* service, TransportType type, const char* #if ADB_HOST SendOkay(reply_fd); #endif - SendProtocolString(reply_fd, listeners); - return 1; + return SendProtocolString(reply_fd, listeners); } if (!strcmp(service, "killforward-all")) { diff --git a/adb/adb_client.cpp b/adb/adb_client.cpp index cb5e48806..bbc4dc72b 100644 --- a/adb/adb_client.cpp +++ b/adb/adb_client.cpp @@ -124,7 +124,7 @@ bool adb_status(int fd, std::string* error) { int _adb_connect(const std::string& service, std::string* error) { D("_adb_connect: %s", service.c_str()); - if (service.empty() || service.size() > 1024) { + if (service.empty() || service.size() > MAX_PAYLOAD_V1) { *error = android::base::StringPrintf("bad service name length (%zd)", service.size()); return -1; diff --git a/adb/adb_io.cpp b/adb/adb_io.cpp index 176b7bd44..ae1683408 100644 --- a/adb/adb_io.cpp +++ b/adb/adb_io.cpp @@ -22,14 +22,16 @@ #include +#include "adb.h" #include "adb_trace.h" #include "adb_utils.h" #include "sysdeps.h" bool SendProtocolString(int fd, const std::string& s) { - int length = s.size(); - if (length > 0xffff) { - length = 0xffff; + unsigned int length = s.size(); + if (length > MAX_PAYLOAD_V1 - 4) { + errno = EMSGSIZE; + return false; } // The cost of sending two strings outweighs the cost of formatting. diff --git a/adb/sockets.cpp b/adb/sockets.cpp index eb0ce85fb..d8e4e9368 100644 --- a/adb/sockets.cpp +++ b/adb/sockets.cpp @@ -698,17 +698,17 @@ static int smart_socket_enqueue(asocket *s, apacket *p) p = s->pkt_first; } - /* don't bother if we can't decode the length */ + /* don't bother if we can't decode the length */ if(p->len < 4) return 0; len = unhex(p->data, 4); - if((len < 1) || (len > 1024)) { + if ((len < 1) || (len > MAX_PAYLOAD_V1)) { D("SS(%d): bad size (%d)", s->id, len); goto fail; } D("SS(%d): len is %d", s->id, len ); - /* can't do anything until we have the full header */ + /* can't do anything until we have the full header */ if((len + 4) > p->len) { D("SS(%d): waiting for %d more bytes", s->id, len+4 - p->len); return 0;