BNEP: Check received frame type (7c3ee84d) · Commits · e / os / android_packages_modules_Bluetooth

system/stack/bnep/bnep_main.cc

+6 −0

Original line number	Diff line number	Diff line
		@@ -451,6 +451,12 @@ static void bnep_data_ind(uint16_t l2cap_cid, BT_HDR* p_buf) {
		type = *p++;
		extension_present = type >> 7;
		type &= 0x7f;
		if (type >= sizeof(bnep_frame_hdr_sizes) / sizeof(bnep_frame_hdr_sizes[0])) {
		BNEP_TRACE_EVENT("BNEP - rcvd frame, bad type: 0x%02x", type);
		android_errorWriteLog(0x534e4554, "68818034");
		osi_free(p_buf);
		return;
		}
		if ((rem_len <= bnep_frame_hdr_sizes[type]) \|\| (rem_len > BNEP_MTU_SIZE)) {
		BNEP_TRACE_EVENT("BNEP - rcvd frame, bad len: %d type: 0x%02x", p_buf->len,
		type);