Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 941ba53f authored by Tom Huang's avatar Tom Huang Committed by Automerger Merge Worker
Browse files

Merge "l2cap: Fix Le Coc payload length checking" am: aa8f2c5b am:... 

Merge "l2cap: Fix Le Coc payload length checking" am: aa8f2c5b am: ddccc8d5 am: a49893c5 am: 16df7f4e

Original change: https://android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/2139392



Change-Id: I4b6d79e9116157326cad38628cd44933c816c84a
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 023d1e24 16df7f4e

system/stack/l2cap/l2c_fcr.cc

+9 −2
Original line number Diff line number Diff line
@@ -681,8 +681,12 @@ void l2c_lcc_proc_pdu(tL2C_CCB* p_ccb, BT_HDR* p_buf) { 


  /* Buffer length should not exceed local mps */

  if (p_buf->len > p_ccb->local_conn_cfg.mps) {

    /* Discard the buffer */

    LOG_ERROR("buffer length=%d exceeds local mps=%d. Drop and disconnect.",

              p_buf->len, p_ccb->local_conn_cfg.mps);



    /* Discard the buffer and disconnect*/

    osi_free(p_buf);

    l2cu_disconnect_chnl(p_ccb);

    return;

  }
@@ -699,8 +703,11 @@ void l2c_lcc_proc_pdu(tL2C_CCB* p_ccb, BT_HDR* p_buf) { 


    /* Check the SDU Length with local MTU size */

    if (sdu_length > p_ccb->local_conn_cfg.mtu) {

      /* Discard the buffer */

      LOG_ERROR("sdu length=%d exceeds local mtu=%d. Drop and disconnect.",

                sdu_length, p_ccb->local_conn_cfg.mtu);

      /* Discard the buffer and disconnect*/

      osi_free(p_buf);

      l2cu_disconnect_chnl(p_ccb);

      return;

    }