Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7f2e3e0e authored by Hansong Zhang's avatar Hansong Zhang
Browse files

DO NOT MERGE Add bounds check for BNEP_Write 

Bug: 74947856
Test: manual
Change-Id: If5db8c6b6e509a330ae74808fc3f0ffac137af14
parent f4e3b60e

system/stack/bnep/bnep_api.cc

+9 −0
Original line number Diff line number Diff line
@@ -23,6 +23,7 @@ 
 ******************************************************************************/



#include "bnep_api.h"

#include <log/log.h>

#include <string.h>

#include "bnep_int.h"
@@ -387,6 +388,10 @@ tBNEP_RESULT BNEP_WriteBuf(uint16_t handle, uint8_t* p_dest_addr, BT_HDR* p_buf, 
        protocol = 0;

      else {

        new_len += 4;

        if (new_len > org_len) {

          android_errorWriteLog(0x534e4554, "74947856");

          return BNEP_IGNORE_CMD;

        }

        p_data[2] = 0;

        p_data[3] = 0;

      }
@@ -483,6 +488,10 @@ tBNEP_RESULT BNEP_Write(uint16_t handle, uint8_t* p_dest_addr, uint8_t* p_data, 
        protocol = 0;

      else {

        new_len += 4;

        if (new_len > org_len) {

          android_errorWriteLog(0x534e4554, "74947856");

          return BNEP_IGNORE_CMD;

        }

        p_data[2] = 0;

        p_data[3] = 0;

      }