Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 06bf297c authored by TreeHugger Robot's avatar TreeHugger Robot Committed by Android (Google) Code Review
Browse files

Merge "DO NOT MERGE Fix OOB read in process_l2cap_cmd" into nyc-dev

parents 11419255 379c3adb

system/stack/l2cap/l2c_main.c

+4 −0
Original line number Diff line number Diff line
@@ -562,6 +562,10 @@ static void process_l2cap_cmd (tL2C_LCB *p_lcb, UINT8 *p, UINT16 pkt_len) 
                    /* sanity check option length */

                    if ((cfg_len + L2CAP_CFG_OPTION_OVERHEAD) <= cmd_len)

                    {

                        if (p + cfg_len > p_next_cmd) {

                            android_errorWriteLog(0x534e4554, "79488381");

                            return;

                        }

                        p += cfg_len;

                        if ((cfg_code & 0x80) == 0)

                        {