diff --git a/dom/bluetooth/bluedroid/BluetoothDaemonGattInterface.cpp b/dom/bluetooth/bluedroid/BluetoothDaemonGattInterface.cpp index 78d78bffced0..905247071b5d 100644 --- a/dom/bluetooth/bluedroid/BluetoothDaemonGattInterface.cpp +++ b/dom/bluetooth/bluedroid/BluetoothDaemonGattInterface.cpp @@ -969,13 +969,13 @@ BluetoothDaemonGattModule::HandleRsp( MOZ_ASSERT(!NS_IsMainThread()); // I/O thread - size_t length = MOZ_ARRAY_LENGTH(HandleRsp) + - MOZ_ARRAY_LENGTH(HandleClientRsp); - bool isInGattArray = HandleRsp[aHeader.mOpcode]; - bool isInGattClientArray = HandleClientRsp[aHeader.mOpcode]; + bool isInGattArray = aHeader.mOpcode < MOZ_ARRAY_LENGTH(HandleRsp) && + HandleRsp[aHeader.mOpcode]; + bool isInGattClientArray = + aHeader.mOpcode < MOZ_ARRAY_LENGTH(HandleClientRsp) && + HandleClientRsp[aHeader.mOpcode]; - if (NS_WARN_IF(!(aHeader.mOpcode < length)) || - NS_WARN_IF(!(isInGattArray || isInGattClientArray))) { + if (NS_WARN_IF(!isInGattArray && !isInGattClientArray)) { return; }