Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 86beb8f5 authored by Ajay Panicker's avatar Ajay Panicker
Browse files

DO NOT MERGE: Add bounds check to l2cble_process_sig_cmd L2CAP_CMD_DISC_REQ 

Bug: 74121659
Test: Compiles
Change-Id: Ib29dd50cee9decda2d73bb79b84215ea4c6ead75
parent da7ed0d4

system/stack/l2cap/l2c_ble.c

+5 −0
Original line number Original line Diff line number Diff line
@@ -32,6 +32,7 @@ 
#include "hcimsgs.h"

#include "hcimsgs.h"

#include "device/include/controller.h"

#include "device/include/controller.h"

#include "stack_config.h"

#include "stack_config.h"

#include "log/log.h"





#if (BLE_INCLUDED == TRUE)

#if (BLE_INCLUDED == TRUE)
@@ -829,6 +830,10 @@ void l2cble_process_sig_cmd (tL2C_LCB *p_lcb, UINT8 *p, UINT16 pkt_len) 
            break;

            break;





        case L2CAP_CMD_DISC_REQ:

        case L2CAP_CMD_DISC_REQ:

            if (p + 4 >= p_pkt_end) {

              android_errorWriteLog(0x534e4554, "63146237");

              return;

            }

            STREAM_TO_UINT16 (lcid, p);

            STREAM_TO_UINT16 (lcid, p);

            STREAM_TO_UINT16 (rcid, p);

            STREAM_TO_UINT16 (rcid, p);