Fix an OOB bug in on_remove_iso_data_path

Bug: 236688764
Test: manul
Ignore-AOSP-First: security
Tag: #security
Change-Id: I0ef4855e715be8fa9a69916e35d3a6c97498a9cc

parent f9f1695e

system/stack/btm/btm_iso_impl.h

+4 −0

Original line number	Diff line number	Diff line
		@@ -307,6 +307,10 @@ struct iso_impl {
		uint8_t status;
		uint16_t conn_handle;

		if (len < 3) {
		LOG(WARNING) << __func__ << "Malformatted packet received";
		return;
		}
		STREAM_TO_UINT8(status, stream);
		STREAM_TO_UINT16(conn_handle, stream);