Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c5993de8 authored by Andrei Emeltchenko's avatar Andrei Emeltchenko Committed by Gustavo Padovan
Browse files

Bluetooth: Correct packet len calculation 



Remove unneeded skb_pull and correct packet length calculation
removing magic number. Move BT_DBG after len check otherwise
it could possibly access wrong memory.

Signed-off-by: default avatarAndrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: default avatarMarcel Holtmann <marcel@holtmann.org>
Signed-off-by: default avatarGustavo F. Padovan <padovan@profusion.mobi>
parent 3542b854

net/bluetooth/hci_event.c

+4 −5
Original line number Diff line number Diff line
@@ -2271,20 +2271,19 @@ static inline void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *s 
	struct hci_ev_num_comp_pkts *ev = (void *) skb->data;

	int i;



	skb_pull(skb, sizeof(*ev));



	BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);



	if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {

		BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);

		return;

	}



	if (skb->len < ev->num_hndl * 4) {

	if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +

			ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {

		BT_DBG("%s bad parameters", hdev->name);

		return;

	}



	BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);



	for (i = 0; i < ev->num_hndl; i++) {

		struct hci_comp_pkts_info *info = &ev->handles[i];

		struct hci_conn *conn;