Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a2bdb448 authored by Hansong Zhang's avatar Hansong Zhang
Browse files

Add bounds check for BNEP_Write 

Bug: 74947856
Test: manual
Change-Id: If5db8c6b6e509a330ae74808fc3f0ffac137af14
parent 5f9c5f0a

system/stack/bnep/bnep_api.cc

+2 −0
Original line number Diff line number Diff line
@@ -378,6 +378,7 @@ tBNEP_RESULT BNEP_WriteBuf(uint16_t handle, const RawAddress& p_dest_addr, 
        protocol = 0;

      else {

        new_len += 4;

        if (new_len > org_len) return BNEP_IGNORE_CMD;

        p_data[2] = 0;

        p_data[3] = 0;

      }
@@ -474,6 +475,7 @@ tBNEP_RESULT BNEP_Write(uint16_t handle, const RawAddress& p_dest_addr, 
        protocol = 0;

      else {

        new_len += 4;

        if (new_len > org_len) return BNEP_IGNORE_CMD;

        p_data[2] = 0;

        p_data[3] = 0;

      }