Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8f8598be authored by Pavlin Radoslavov's avatar Pavlin Radoslavov
Browse files

Add missing extension length check while parsing BNEP control packets 

Bug: 63146237
Test: External script
Change-Id: I4e519cec1c7dffb8bd42add00bd891e0969a3d9f
(cherry picked from commit 9ab89b7dbe5735b796799f65144efa48595d0230)
(cherry picked from commit 0754be1b)
(cherry picked from commit c7874f25a0557ca4413d8db80bab8da842fc389a)
(cherry picked from commit 187bd8aec0aae63c6328981041e5ec7764ece6a9)
parent 45db9edf

system/stack/bnep/bnep_utils.c

+1 −1
Original line number Diff line number Diff line
@@ -907,7 +907,7 @@ UINT8 *bnep_process_control_packet (tBNEP_CONN *p_bcb, UINT8 *p, UINT16 *rem_len 
        BNEP_TRACE_ERROR("%s: BNEP - bad ctl pkt type: %d", __func__,

                         control_type);

        bnep_send_command_not_understood (p_bcb, control_type);

        if (is_ext)

        if (is_ext && (ext_len > 0))

        {

            if (*rem_len < (ext_len - 1)) {

                goto bad_packet_length;