Code: static future_t *init(void) {
  pthread_mutex_init(&lock, NULL);
  config = config_new(CONFIG_FILE_PATH);
 if (!config) {
    LOG_WARN(LOG_TAG, "%s unable to load config file; attempting to transcode legacy file.", __func__);
    config = btif_config_transcode(LEGACY_CONFIG_FILE_PATH);
 if (!config) {
      LOG_WARN(LOG_TAG, "%s unable to transcode legacy file, starting unconfigured.", __func__);
      config = config_new_empty();
 if (!config) {
        LOG_ERROR(LOG_TAG, "%s unable to allocate a config object.", __func__);
 goto error;
 }
 }

 if (config_save(config, CONFIG_FILE_PATH))

       unlink(LEGACY_CONFIG_FILE_PATH);
   }
 
  alarm_timer = alarm_new();
 if (!alarm_timer) {
    LOG_ERROR(LOG_TAG, "%s unable to create alarm.", __func__);
 goto error;
 }

 return future_new_immediate(FUTURE_SUCCESS);

error:;
  alarm_free(alarm_timer);
  config_free(config);
  pthread_mutex_destroy(&lock);
  alarm_timer = NULL;
  config = NULL;
 return future_new_immediate(FUTURE_FAIL);
}

Vulnerability Type: DoS Overflow Mem. Corr. 
CWE ID: CWE-119
Summary: btif_config.c in Bluetooth in Android 6.x before 2016-03-01 allows remote attackers to cause a denial of service (memory corruption and persistent daemon crash) by triggering a large number of configuration entries, and consequently exceeding the maximum size of a configuration file, aka internal bug 26071376.
Commit Message: Fix crashes with lots of discovered LE devices

When loads of devices are discovered a config file which is too large
can be written out, which causes the BT daemon to crash on startup.

This limits the number of config entries for unpaired devices which
are initialized, and prevents a large number from being saved to the
filesystem.

Bug: 26071376
Change-Id: I4a74094f57a82b17f94e99a819974b8bc8082184
