Merge "DO NOT MERGE - Check SDU lower bound before allocate p_data" into oc-mr1-dev (8aed32e7) · Commits · e / os / android_packages_modules_Bluetooth

system/stack/l2cap/l2c_fcr.cc

+9 −0

Original line number	Original line	Diff line number	Diff line
	@@ -24,6 +24,7 @@
	******************************************************************************/		******************************************************************************/

	#include <base/logging.h>		#include <base/logging.h>
			#include <log/log.h>
	#include <stdio.h>		#include <stdio.h>
	#include <stdlib.h>		#include <stdlib.h>
	#include <string.h>		#include <string.h>
	@@ -841,6 +842,14 @@ void l2c_lcc_proc_pdu(tL2C_CCB* p_ccb, BT_HDR* p_buf) {
	return;		return;
	}		}

			if (sdu_length < p_buf->len) {
			L2CAP_TRACE_ERROR("%s: Invalid sdu_length: %d", __func__, sdu_length);
			android_errorWriteWithInfoLog(0x534e4554, "112321180", -1, NULL, 0);
			/* Discard the buffer */
			osi_free(p_buf);
			return;
			}

	p_data = (BT_HDR*)osi_malloc(L2CAP_MAX_BUF_SIZE);		p_data = (BT_HDR*)osi_malloc(L2CAP_MAX_BUF_SIZE);
	if (p_data == NULL) {		if (p_data == NULL) {
	osi_free(p_buf);		osi_free(p_buf);