Merge "Add bounds check to l2cble_process_sig_cmd L2CAP_CMD_DISC_REQ" into oc-dev (2dce956a) · Commits · e / os / android_packages_modules_Bluetooth

system/stack/l2cap/l2c_ble.cc

+5 −0

Original line number	Diff line number	Diff line
		@@ -31,6 +31,7 @@
		#include "hcimsgs.h"
		#include "l2c_int.h"
		#include "l2cdefs.h"
		#include "log/log.h"
		#include "osi/include/osi.h"
		#include "stack_config.h"

		@@ -799,6 +800,10 @@ void l2cble_process_sig_cmd(tL2C_LCB* p_lcb, uint8_t* p, uint16_t pkt_len) {
		break;

		case L2CAP_CMD_DISC_REQ:
		if (p + 4 > p_pkt_end) {
		android_errorWriteLog(0x534e4554, "74121659");
		return;
		}
		STREAM_TO_UINT16(lcid, p);
		STREAM_TO_UINT16(rcid, p);