Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bb4fa4e2 authored by Brian Delwiche's avatar Brian Delwiche Committed by Automerger Merge Worker
Browse files

[RESTRICT AUTOMERGE] Fix potential use after free in pan_api.cc am: c7b0b8ac 

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/22189109



Change-Id: I1eb1f0b48a1f5bbae431403970730d545c1e9547
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 28d8f0b1 c7b0b8ac

system/stack/pan/pan_api.cc

+7 −1
Original line number Diff line number Diff line
@@ -509,6 +509,12 @@ tPAN_RESULT PAN_WriteBuf(uint16_t handle, const RawAddress& dst, 
      return PAN_FAILURE;

    }



    /* There are cases where BNAP_WriteBuf alters p_buf->len.  However,

     * the octets being handled are only used later by PAN for logging

     * purposes, and for those purposes this length is arguably correct --

     * it is the number of bytes handled at the PAN level. */

    uint16_t bytes = p_buf->len;



    result =

        BNEP_WriteBuf(pan_cb.pcb[i].handle, dst, p_buf, protocol, &src, ext);

    if (result == BNEP_IGNORE_CMD) {
@@ -519,7 +525,7 @@ tPAN_RESULT PAN_WriteBuf(uint16_t handle, const RawAddress& dst, 
      return (tPAN_RESULT)result;

    }



    pan_cb.pcb[i].write.octets += p_buf->len;

    pan_cb.pcb[i].write.octets += bytes;

    pan_cb.pcb[i].write.packets++;



    PAN_TRACE_DEBUG("PAN successfully wrote data for the PANU connection");