Merge "DO NOT MERGE Add bounds check for BNEP_Write" into oc-dev (1c39e47f) · Commits · e / os / android_packages_modules_Bluetooth

system/stack/bnep/bnep_api.cc

+9 −0

Original line number	Diff line number	Diff line
		@@ -23,6 +23,7 @@
		******************************************************************************/

		#include "bnep_api.h"
		#include <log/log.h>
		#include <string.h>
		#include "bnep_int.h"

		@@ -387,6 +388,10 @@ tBNEP_RESULT BNEP_WriteBuf(uint16_t handle, uint8_t* p_dest_addr, BT_HDR* p_buf,
		protocol = 0;
		else {
		new_len += 4;
		if (new_len > org_len) {
		android_errorWriteLog(0x534e4554, "74947856");
		return BNEP_IGNORE_CMD;
		}
		p_data[2] = 0;
		p_data[3] = 0;
		}
		@@ -483,6 +488,10 @@ tBNEP_RESULT BNEP_Write(uint16_t handle, uint8_t* p_dest_addr, uint8_t* p_data,
		protocol = 0;
		else {
		new_len += 4;
		if (new_len > org_len) {
		android_errorWriteLog(0x534e4554, "74947856");
		return BNEP_IGNORE_CMD;
		}
		p_data[2] = 0;
		p_data[3] = 0;
		}