Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2d186cb6 authored by TreeHugger Robot's avatar TreeHugger Robot Committed by Android (Google) Code Review
Browse files

Merge "Fix out of bounds read in l2c_rcv_acl_data" into oc-dev

parents e3e79d58 ac57cd5a

system/stack/l2cap/l2c_main.cc

+1 −3
Original line number Original line Diff line number Diff line
@@ -68,7 +68,7 @@ void l2c_rcv_acl_data(BT_HDR* p_msg) { 
  uint8_t pkt_type;

  uint8_t pkt_type;

  tL2C_LCB* p_lcb;

  tL2C_LCB* p_lcb;

  tL2C_CCB* p_ccb = NULL;

  tL2C_CCB* p_ccb = NULL;

  uint16_t l2cap_len, rcv_cid, psm;

  uint16_t l2cap_len, rcv_cid;

  uint16_t credit;

  uint16_t credit;





  /* Extract the handle */

  /* Extract the handle */
@@ -176,8 +176,6 @@ void l2c_rcv_acl_data(BT_HDR* p_msg) { 
    osi_free(p_msg);

    osi_free(p_msg);

  } else if (rcv_cid == L2CAP_CONNECTIONLESS_CID) {

  } else if (rcv_cid == L2CAP_CONNECTIONLESS_CID) {

    /* process_connectionless_data (p_lcb); */

    /* process_connectionless_data (p_lcb); */

    STREAM_TO_UINT16(psm, p);

    L2CAP_TRACE_DEBUG("GOT CONNECTIONLESS DATA PSM:%d", psm);





#if (L2CAP_UCD_INCLUDED == TRUE)

#if (L2CAP_UCD_INCLUDED == TRUE)

    /* if it is not broadcast, check UCD registration */

    /* if it is not broadcast, check UCD registration */