Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 379c3adb authored by Hansong Zhang's avatar Hansong Zhang
Browse files

DO NOT MERGE Fix OOB read in process_l2cap_cmd 

Test: manual
Bug: 79488381
Change-Id: I723866ed40d3647fed99875f659bb95df96a6969
parent 5d718c2b

system/stack/l2cap/l2c_main.c

+4 −0
Original line number Diff line number Diff line
@@ -562,6 +562,10 @@ static void process_l2cap_cmd (tL2C_LCB *p_lcb, UINT8 *p, UINT16 pkt_len) 
                    /* sanity check option length */

                    if ((cfg_len + L2CAP_CFG_OPTION_OVERHEAD) <= cmd_len)

                    {

                        if (p + cfg_len > p_next_cmd) {

                            android_errorWriteLog(0x534e4554, "79488381");

                            return;

                        }

                        p += cfg_len;

                        if ((cfg_code & 0x80) == 0)

                        {