Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 25bb5694 authored by Chienyuan's avatar Chienyuan
Browse files

Fix OOB in process_l2cap_cmd 

Bug: 111215173
Test: manual
Change-Id: I98c122fea64cb33a9b0986254685091bcc8a951b
parent b19914e1

system/stack/l2cap/l2c_main.cc

+4 −0
Original line number Diff line number Diff line
@@ -721,6 +721,10 @@ static void process_l2cap_cmd(tL2C_LCB* p_lcb, uint8_t* p, uint16_t pkt_len) { 
#if (L2CAP_NUM_FIXED_CHNLS > 0)

        if (info_type == L2CAP_FIXED_CHANNELS_INFO_TYPE) {

          if (result == L2CAP_INFO_RESP_RESULT_SUCCESS) {

            if (p + L2CAP_FIXED_CHNL_ARRAY_SIZE > p_next_cmd) {

              android_errorWriteLog(0x534e4554, "111215173");

              return;

            }

            memcpy(p_lcb->peer_chnl_mask, p, L2CAP_FIXED_CHNL_ARRAY_SIZE);

          }