Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 521621d5 authored by Myles Watson's avatar Myles Watson
Browse files

Bluetooth: Check H4 HCI packet types 

An invalid type byte can cause an access outside
the bounds of the array.

Bug: 64565737
Test: Bluetooth On/Off
Change-Id: Ie11dd62942f66b9fc60ebce2e4339c37d597fdf0
parent 36cb0a2d

bluetooth/1.0/default/h4_protocol.cc

+6 −0
Original line number Diff line number Diff line
@@ -81,6 +81,12 @@ void H4Protocol::OnDataReady(int fd) { 
      }

    }

    hci_packet_type_ = static_cast<HciPacketType>(buffer[0]);

    if (hci_packet_type_ != HCI_PACKET_TYPE_ACL_DATA &&

        hci_packet_type_ != HCI_PACKET_TYPE_SCO_DATA &&

        hci_packet_type_ != HCI_PACKET_TYPE_EVENT) {

      LOG_ALWAYS_FATAL("%s: Unimplemented packet type %d", __func__,

                       static_cast<int>(hci_packet_type_));

    }

  } else {

    hci_packetizer_.OnDataReady(fd, hci_packet_type_);

  }