Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit adb5c32f authored by Chienyuan's avatar Chienyuan Committed by Xin Li
Browse files

Fix OOB of L2CAP_CMD_CREDIT_BASED_CONN_RES 

TAG: #security
Bug: 213519176
Test: manual
Merged-In: Ieb6ebc88a40d044a0bbb3311fe2f5b7d5b571b9e
Change-Id: Ieb6ebc88a40d044a0bbb3311fe2f5b7d5b571b9e
parent 448cac34

system/stack/l2cap/l2c_ble.cc

+1 −1
Original line number Diff line number Diff line
@@ -628,7 +628,7 @@ void l2cble_process_sig_cmd(tL2C_LCB* p_lcb, uint8_t* p, uint16_t pkt_len) { 
      break;

    }

    case L2CAP_CMD_CREDIT_BASED_CONN_RES:

      if (p + 2 > p_pkt_end) {

      if (p + 8 > p_pkt_end) {

        LOG(ERROR) << "invalid L2CAP_CMD_CREDIT_BASED_CONN_RES len";

        return;

      }