Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ac57cd5a authored by Jakub Pawlowski's avatar Jakub Pawlowski
Browse files

Fix out of bounds read in l2c_rcv_acl_data 

Test: none
Bug: 80432895
Change-Id: I7807d00c02a84c545476e84bc1b71e0718df1f24
Merged-In: I7807d00c02a84c545476e84bc1b71e0718df1f24
parent 13dca96c

system/stack/l2cap/l2c_main.cc

+1 −3
Original line number Original line Diff line number Diff line
@@ -68,7 +68,7 @@ void l2c_rcv_acl_data(BT_HDR* p_msg) { 
  uint8_t pkt_type;

  uint8_t pkt_type;

  tL2C_LCB* p_lcb;

  tL2C_LCB* p_lcb;

  tL2C_CCB* p_ccb = NULL;

  tL2C_CCB* p_ccb = NULL;

  uint16_t l2cap_len, rcv_cid, psm;

  uint16_t l2cap_len, rcv_cid;

  uint16_t credit;

  uint16_t credit;





  /* Extract the handle */

  /* Extract the handle */
@@ -176,8 +176,6 @@ void l2c_rcv_acl_data(BT_HDR* p_msg) { 
    osi_free(p_msg);

    osi_free(p_msg);

  } else if (rcv_cid == L2CAP_CONNECTIONLESS_CID) {

  } else if (rcv_cid == L2CAP_CONNECTIONLESS_CID) {

    /* process_connectionless_data (p_lcb); */

    /* process_connectionless_data (p_lcb); */

    STREAM_TO_UINT16(psm, p);

    L2CAP_TRACE_DEBUG("GOT CONNECTIONLESS DATA PSM:%d", psm);





#if (L2CAP_UCD_INCLUDED == TRUE)

#if (L2CAP_UCD_INCLUDED == TRUE)

    /* if it is not broadcast, check UCD registration */

    /* if it is not broadcast, check UCD registration */