Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 616a47bb authored by Cheney Ni's avatar Cheney Ni
Browse files

Add packet length checks in mca_ccb_hdl_req 

Bug: 110791536
Test: manual
Change-Id: Ica5d8037246682fdb190b2747a86ed8d44c2869a
parent bf5efcde

system/stack/mcap/mca_cact.cc

+8 −1
Original line number Original line Diff line number Diff line
@@ -22,6 +22,7 @@ 
 *  Functions.

 *  Functions.

 *

 *

 ******************************************************************************/

 ******************************************************************************/

#include <log/log.h>

#include <string.h>

#include <string.h>

#include "bt_common.h"

#include "bt_common.h"

#include "bt_target.h"

#include "bt_target.h"
@@ -253,9 +254,15 @@ void mca_ccb_hdl_req(tMCA_CCB* p_ccb, tMCA_CCB_EVT* p_data) { 
  p_rx_msg = (tMCA_CCB_MSG*)p_pkt;

  p_rx_msg = (tMCA_CCB_MSG*)p_pkt;

  p = (uint8_t*)(p_pkt + 1) + p_pkt->offset;

  p = (uint8_t*)(p_pkt + 1) + p_pkt->offset;

  evt_data.hdr.op_code = *p++;

  evt_data.hdr.op_code = *p++;

  BE_STREAM_TO_UINT16(evt_data.hdr.mdl_id, p);

  reject_opcode = evt_data.hdr.op_code + 1;

  reject_opcode = evt_data.hdr.op_code + 1;





  if (p_pkt->len >= 3) {

    BE_STREAM_TO_UINT16(evt_data.hdr.mdl_id, p);

  } else {

    android_errorWriteLog(0x534e4554, "110791536");

    evt_data.hdr.mdl_id = 0;

  }



  MCA_TRACE_DEBUG("received mdl id: %d ", evt_data.hdr.mdl_id);

  MCA_TRACE_DEBUG("received mdl id: %d ", evt_data.hdr.mdl_id);

  if (p_ccb->status == MCA_CCB_STAT_PENDING) {

  if (p_ccb->status == MCA_CCB_STAT_PENDING) {

    MCA_TRACE_DEBUG("received req inpending state");

    MCA_TRACE_DEBUG("received req inpending state");