Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8da29e06 authored by Chienyuan's avatar Chienyuan
Browse files

Fix OOB in reassemble_and_dispatch 

Bug: 112106425
Test: manual
Change-Id: Iae982473096f8deacf475dfdc9d0bcd6e0c13e6d
parent e702e71b

system/hci/src/packet_fragmenter.cc

+5 −0
Original line number Diff line number Diff line
@@ -126,6 +126,11 @@ static void reassemble_and_dispatch(UNUSED_ATTR BT_HDR* packet) { 
    uint16_t l2cap_length;

    uint16_t acl_length;



    if (packet->len < 6) {

      LOG_WARN(LOG_TAG, "%s invalid packet length %d", __func__, packet->len);

      return;

    }



    STREAM_TO_UINT16(handle, stream);

    STREAM_TO_UINT16(acl_length, stream);

    STREAM_TO_UINT16(l2cap_length, stream);