Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c8130dee authored by Kilsung Yu's avatar Kilsung Yu Committed by Chris Manton
Browse files

l2cap: Host Crash Observed in L2CAP_ECFC_BV-20-C

Referenced null point becasue cid is 0 when some connections refused
Test: Manual

Change-Id: I5239ba853345180868aef633171a84c5550dccbc
parent 9d718b1d
Loading
Loading
Loading
Loading

system/stack/l2cap/l2c_csm.cc

100644 → 100755
+15 −5
Original line number Diff line number Diff line
@@ -823,7 +823,13 @@ static void l2c_csm_w4_l2ca_connect_rsp(tL2C_CCB* p_ccb, tL2CEVT event,

      for (int i = 0; i < p_ccb->p_lcb->pending_ecoc_conn_cnt; i++) {
        uint16_t cid = p_ccb->p_lcb->pending_ecoc_connection_cids[i];
        if (cid == 0) {
            LOG_WARN("pending_ecoc_connection_cids[%d] is %d", i, cid);
            continue;
        }

        tL2C_CCB* temp_p_ccb = l2cu_find_ccb_by_cid(p_ccb->p_lcb, cid);
        if (temp_p_ccb) {
          auto it = std::find(p_ci->lcids.begin(), p_ci->lcids.end(), cid);
          if (it != p_ci->lcids.end()) {
            temp_p_ccb->chnl_state = CST_OPEN;
@@ -831,6 +837,10 @@ static void l2c_csm_w4_l2ca_connect_rsp(tL2C_CCB* p_ccb, tL2CEVT event,
            l2cu_release_ccb(temp_p_ccb);
          }
        }
        else {
            LOG_WARN("temp_p_ccb is NULL, pending_ecoc_connection_cids[%d] is %d", i, cid);
        }
      }
      p_ccb->p_lcb->pending_ecoc_conn_cnt = 0;
      memset(p_ccb->p_lcb->pending_ecoc_connection_cids, 0,
             L2CAP_CREDIT_BASED_MAX_CIDS);