Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 604ae13b authored by liuchao's avatar liuchao Committed by Marie Janssen
Browse files

Fix invvalid lcid check in mca_tc_tbl_by_lcid() 

This fixes a potential bug when (lcid - L2CAP_BASE_APPL_CID) 
is used as an array index.

Test: mm -j 8
Change-Id: I7f917bf66e4002f65cf1c0bec02eff7d39181790
parent 02e2c6e8

system/stack/mcap/mca_main.cc

+2 −2
Original line number Diff line number Diff line
@@ -190,7 +190,7 @@ tMCA_TC_TBL* mca_tc_tbl_dalloc(tMCA_DCB* p_dcb) { 
tMCA_TC_TBL* mca_tc_tbl_by_lcid(uint16_t lcid) {

  uint8_t idx;



  if (lcid) {

  if (lcid >= L2CAP_BASE_APPL_CID) {

    idx = mca_cb.tc.lcid_tbl[lcid - L2CAP_BASE_APPL_CID];



    if (idx < MCA_NUM_TC_TBL) {
@@ -213,7 +213,7 @@ tMCA_TC_TBL* mca_tc_tbl_by_lcid(uint16_t lcid) { 
void mca_free_tc_tbl_by_lcid(uint16_t lcid) {

  uint8_t idx;



  if (lcid) {

  if (lcid >= L2CAP_BASE_APPL_CID) {

    idx = mca_cb.tc.lcid_tbl[lcid - L2CAP_BASE_APPL_CID];



    if (idx < MCA_NUM_TC_TBL) {