Merge "HID Host: Check L2CAP packet data length" into oc-dev (13dca96c) · Commits · e / os / android_packages_modules_Bluetooth

system/stack/hid/hidh_conn.cc

+9 −0

Original line number	Diff line number	Diff line
		@@ -42,6 +42,7 @@
		#include "hidh_api.h"
		#include "hidh_int.h"

		#include "log/log.h"
		#include "osi/include/osi.h"

		extern fixed_queue_t* btu_general_alarm_queue;
		@@ -799,6 +800,14 @@ static void hidh_l2cif_data_ind(uint16_t l2cap_cid, BT_HDR* p_msg) {
		return;
		}

		if (p_msg->len < 1) {
		HIDH_TRACE_WARNING("Rcvd L2CAP data, invalid length %d, should be >= 1",
		p_msg->len);
		osi_free(p_msg);
		android_errorWriteLog(0x534e4554, "80493272");
		return;
		}

		ttype = HID_GET_TRANS_FROM_HDR(*p_data);
		param = HID_GET_PARAM_FROM_HDR(*p_data);
		rep_type = param & HID_PAR_REP_TYPE_MASK;