From ccf87aa54da9b4460468476cd1308454394d5e5f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jos=C3=A9=20Rebelo?= <joserebelo@outlook.com>
Date: Sat, 9 May 2026 18:45:56 +0100
Subject: [PATCH] Huawei: Fix OOM when raw data is received instead of TLV

---
 .../gadgetbridge/devices/huawei/HuaweiTLV.java               | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/app/src/main/java/nodomain/freeyourgadget/gadgetbridge/devices/huawei/HuaweiTLV.java b/app/src/main/java/nodomain/freeyourgadget/gadgetbridge/devices/huawei/HuaweiTLV.java
index c94d0dcfc8..e7cb52ab2c 100644
--- a/app/src/main/java/nodomain/freeyourgadget/gadgetbridge/devices/huawei/HuaweiTLV.java
+++ b/app/src/main/java/nodomain/freeyourgadget/gadgetbridge/devices/huawei/HuaweiTLV.java
@@ -132,6 +132,11 @@ public class HuaweiTLV {
             VarInt varInt = new VarInt(buffer, offset + parsed);
             int size = varInt.dValue;
             parsed += varInt.size;
+            if (size < 0 || size > length - parsed) {
+                throw new ArrayIndexOutOfBoundsException(
+                        "TLV element size " + size + " exceeds remaining buffer length " + (length - parsed)) {
+                };
+            }
             byte[] value = new byte[size];
             System.arraycopy(buffer, offset + parsed, value, 0, size);
             put(tag, value);