Merge cherrypicks of [4787631, 4787901, 4785407, 4787495, 4788077, 4788078, 4788079, 4788280, 4787496, 4787137, 4786086, 4786087, 4786088, 4786089, 4786090, 4786091, 4787632, 4788320, 4785408] into pi-dr1-releaseandroid-9.0.0_r12android-9.0.0_r11pie-dr1-release

Change-Id: I589c932962e9a693ad362fc3cf60003cb49499c9

1 files changed, 11 insertions, 1 deletions

diff --git a/src/transport_tests.cc b/src/transport_tests.cc
index 794135b..b57ccae 100644
--- a/src/transport_tests.cc
+++ b/src/transport_tests.cc
@@ -176,10 +176,20 @@ bool StatusMatches(const transport_status& arg, uint32_t status, uint16_t flags,
   ok &= arg.version == TRANSPORT_V1;
   ok &= arg.flags == flags;
 
+  // Check the status is a valid length
+  if (arg.length < STATUS_MIN_LENGTH || arg.length > STATUS_MAX_LENGTH) {
+    return false;
+  }
+
+  // As of v1, the length shouldn\t be greater than transport_status
+  if (arg.length > sizeof(transport_status)) {
+    return false;
+  }
+
+  // Check the CRCs are valid
   transport_status st = arg;
   st.crc = 0;
   ok &= arg.crc == crc16(&st, st.length);
-
   ok &= arg.reply_crc == crc16(reply, reply_len);
 
   return ok;