Merge "Fix OOB in process_l2cap_cmd" (9c529005) · Commits · e / os / android_packages_modules_Bluetooth

system/stack/l2cap/l2c_main.cc

+4 −0

Original line number	Diff line number	Diff line
		@@ -721,6 +721,10 @@ static void process_l2cap_cmd(tL2C_LCB* p_lcb, uint8_t* p, uint16_t pkt_len) {
		#if (L2CAP_NUM_FIXED_CHNLS > 0)
		if (info_type == L2CAP_FIXED_CHANNELS_INFO_TYPE) {
		if (result == L2CAP_INFO_RESP_RESULT_SUCCESS) {
		if (p + L2CAP_FIXED_CHNL_ARRAY_SIZE > p_next_cmd) {
		android_errorWriteLog(0x534e4554, "111215173");
		return;
		}
		memcpy(p_lcb->peer_chnl_mask, p, L2CAP_FIXED_CHNL_ARRAY_SIZE);
		}