Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c9471247 authored by Ugo Yu's avatar Ugo Yu
Browse files

DO NOT MERGE - Check SDU lower bound before allocate p_data 

Bug: 112321180
Test: SL4A BleCocTest:test_coc_insecured_connection_write_ascii
Change-Id: Id0c9aa2097f0b6bdc2bb9fa9086daa9452188e1d
Merged-In: Id0c9aa2097f0b6bdc2bb9fa9086daa9452188e1d
parent 93c98c20

system/stack/l2cap/l2c_fcr.cc

+8 −0
Original line number Diff line number Diff line
@@ -845,6 +845,14 @@ void l2c_lcc_proc_pdu(tL2C_CCB* p_ccb, BT_HDR* p_buf) { 
      return;

    }



    if (sdu_length < p_buf->len) {

      L2CAP_TRACE_ERROR("%s: Invalid sdu_length: %d", __func__, sdu_length);

      android_errorWriteWithInfoLog(0x534e4554, "112321180", -1, NULL, 0);

      /* Discard the buffer */

      osi_free(p_buf);

      return;

    }



    p_data = (BT_HDR*)osi_malloc(L2CAP_MAX_BUF_SIZE);

    if (p_data == NULL) {

      osi_free(p_buf);