QLeAdvertiserBluez::handleCommandCompleted(): check data sizeHEADdev

When reading the reply for the OcfLeReadTxPowerLevel command, check
that the data is not empty before accessing the first byte.

In practice the reply should always contain this byte, because this
command tries to read the power level from the local adapter, not from
some remote untrusted device.

Pick-to: 6.9 6.8 6.5
Change-Id: Iaa504f00a260b438e323e4e0f81ab84a31cd85b5
Reviewed-by: Juha Vuolle <[email protected]>

1 files changed, 4 insertions, 1 deletions

diff --git a/src/bluetooth/qleadvertiser_bluez.cpp b/src/bluetooth/qleadvertiser_bluez.cpp
index 27e95043..430a876b 100644
--- a/src/bluetooth/qleadvertiser_bluez.cpp
+++ b/src/bluetooth/qleadvertiser_bluez.cpp
@@ -414,7 +414,10 @@ void QLeAdvertiserBluez::handleCommandCompleted(quint16 opCode, quint8 status,
     switch (ocf) {
     case QBluezConst::OcfLeReadTxPowerLevel:
         if (m_sendPowerLevel) {
-            m_powerLevel = data.at(0);
+            if (!data.isEmpty())
+                m_powerLevel = data.at(0);
+            else
+                m_powerLevel = 0;
             qCDebug(QT_BT_BLUEZ) << "TX power level is" << m_powerLevel;
         }
         queueAdvertisingCommands();