Commit aae7fe22 authored Sep 15, 2010 by Andrei Emeltchenko Committed by Gustavo Padovan Oct 12, 2010

Bluetooth: check for l2cap header in start fragment



BLUETOOTH SPECIFICATION Version 4.0 [Vol 3] page 36 mentioned
"Note: Start Fragments always begin with the Basic L2CAP header
of a PDU."

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>

parent 89794813

net/bluetooth/l2cap.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -4675,7 +4675,8 @@ static int l2cap_recv_acldata(struct hci_conn hcon, struct sk_buff skb, u16 fl
		l2cap_conn_unreliable(conn, ECOMM);
		}

		if (skb->len < 2) {
		/* Start fragment always begin with Basic L2CAP header */
		if (skb->len < L2CAP_HDR_SIZE) {
		BT_ERR("Frame is too short (len %d)", skb->len);
		l2cap_conn_unreliable(conn, ECOMM);
		goto drop;