Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3deb5ec3 authored by Stanley Tng's avatar Stanley Tng
Browse files

Fix the LE CoC SL4A Test failure due to length check 

Fix a regression from the previous CL that checks the buffer length
before doing a memcpy. The previous check is too strict causing valid
sized buffers to be rejected. The length check is incorrect and off by the header size.

Bug: 117306992
Bug: 112321180
Test: Run the LE CoC SL4A Tests
Change-Id: I9bbcd58460a02394010f74a18e9ebdbcd546d43d
parent e104da56

system/stack/l2cap/l2c_fcr.cc

+2 −1
Original line number Diff line number Diff line
@@ -843,6 +843,8 @@ void l2c_lcc_proc_pdu(tL2C_CCB* p_ccb, BT_HDR* p_buf) { 
      return;

    }



    p_buf->len -= sizeof(sdu_length);



    if (sdu_length < p_buf->len) {

      L2CAP_TRACE_ERROR("%s: Invalid sdu_length: %d", __func__, sdu_length);

      android_errorWriteWithInfoLog(0x534e4554, "112321180", -1, NULL, 0);
@@ -861,7 +863,6 @@ void l2c_lcc_proc_pdu(tL2C_CCB* p_ccb, BT_HDR* p_buf) { 
    p_data->len = 0;

    p_ccb->ble_sdu_length = sdu_length;

    L2CAP_TRACE_DEBUG("%s SDU Length = %d", __func__, sdu_length);

    p_buf->len -= sizeof(sdu_length);

    p_buf->offset += sizeof(sdu_length);

    p_data->offset = 0;