Merge "DO NOT MERGE Add bounds check for BNEP_Write" into oc-dev am: 1c39e47fbf (70afd982) · Commits · e / os / android_packages_modules_Bluetooth

system/stack/bnep/bnep_api.cc

+9 −0

Original line number	Diff line number	Diff line
		@@ -23,6 +23,7 @@
		******************************************************************************/

		#include "bnep_api.h"
		#include <log/log.h>
		#include <string.h>
		#include "bnep_int.h"

		@@ -383,6 +384,10 @@ tBNEP_RESULT BNEP_WriteBuf(uint16_t handle, const RawAddress& p_dest_addr,
		protocol = 0;
		else {
		new_len += 4;
		if (new_len > org_len) {
		android_errorWriteLog(0x534e4554, "74947856");
		return BNEP_IGNORE_CMD;
		}
		p_data[2] = 0;
		p_data[3] = 0;
		}
		@@ -479,6 +484,10 @@ tBNEP_RESULT BNEP_Write(uint16_t handle, const RawAddress& p_dest_addr,
		protocol = 0;
		else {
		new_len += 4;
		if (new_len > org_len) {
		android_errorWriteLog(0x534e4554, "74947856");
		return BNEP_IGNORE_CMD;
		}
		p_data[2] = 0;
		p_data[3] = 0;
		}