Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c3fde45e authored by Ted Wang's avatar Ted Wang
Browse files

Fix integer underflow in rfc_parse_data 

Bug: 120255805
Test: manual
Change-Id: Ic722c7b3c7255549251aa30c910bd3475bb192cd
parent ef4b27e0

system/stack/rfcomm/rfc_ts_frames.cc

+5 −0
Original line number Diff line number Diff line
@@ -533,6 +533,11 @@ uint8_t rfc_parse_data(tRFC_MCB* p_mcb, MX_FRAME* p_frame, BT_HDR* p_buf) { 
    return RFC_EVENT_BAD_FRAME;

  }



  if (p_buf->len < (3 + !ead + !eal + 1)) {

    android_errorWriteLog(0x534e4554, "120255805");

    RFCOMM_TRACE_ERROR("Bad Length: %d", p_buf->len);

    return RFC_EVENT_BAD_FRAME;

  }

  p_buf->len -= (3 + !ead + !eal + 1); /* Additional 1 for FCS */

  p_buf->offset += (3 + !ead + !eal);