Merge "Add packet length checks in mca_ccb_hdl_req" into oc-dev (8b150e94) · Commits · e / os / android_packages_modules_Bluetooth

system/stack/mcap/mca_cact.cc

+8 −1

Original line number	Diff line number	Diff line
		@@ -22,6 +22,7 @@
		* Functions.
		*
		******************************************************************************/
		#include <log/log.h>
		#include <string.h>
		#include "bt_common.h"
		#include "bt_target.h"
		@@ -253,9 +254,15 @@ void mca_ccb_hdl_req(tMCA_CCB* p_ccb, tMCA_CCB_EVT* p_data) {
		p_rx_msg = (tMCA_CCB_MSG*)p_pkt;
		p = (uint8_t*)(p_pkt + 1) + p_pkt->offset;
		evt_data.hdr.op_code = *p++;
		BE_STREAM_TO_UINT16(evt_data.hdr.mdl_id, p);
		reject_opcode = evt_data.hdr.op_code + 1;

		if (p_pkt->len >= 3) {
		BE_STREAM_TO_UINT16(evt_data.hdr.mdl_id, p);
		} else {
		android_errorWriteLog(0x534e4554, "110791536");
		evt_data.hdr.mdl_id = 0;
		}

		MCA_TRACE_DEBUG("received mdl id: %d ", evt_data.hdr.mdl_id);
		if (p_ccb->status == MCA_CCB_STAT_PENDING) {
		MCA_TRACE_DEBUG("received req inpending state");