Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a735e632 authored by Hansong Zhang's avatar Hansong Zhang Committed by Bryan Ferris
Browse files

L2CAP: Check length for packet before connection complete 

Bug: 141745011
Test: Run POC
Change-Id: I9dc27521fa2e7f6ea345ec65dc9d3e873d71ef0f
parent b806184d

system/stack/l2cap/l2c_main.cc

+5 −0
Original line number Diff line number Diff line
@@ -97,6 +97,11 @@ void l2c_rcv_acl_data(BT_HDR* p_msg) { 
    /* There is a slight possibility (specifically with USB) that we get an */

    /* L2CAP connection request before we get the HCI connection complete.  */

    /* So for these types of messages, hold them for up to 2 seconds.       */

    if (l2cap_len == 0) {

      L2CAP_TRACE_WARNING("received empty L2CAP packet");

      osi_free(p_msg);

      return;

    }

    uint8_t cmd_code;

    STREAM_TO_UINT8(cmd_code, p);