[automerger] DO NOT MERGE Add bounds check for BNEP_Write am: b7ffb21711 am:... (dbc1815b) · Commits · e / os / android_packages_modules_Bluetooth

system/stack/bnep/bnep_api.c

+9 −0

Original line number	Diff line number	Diff line
		@@ -25,6 +25,7 @@
		#include <string.h>
		#include "bnep_api.h"
		#include "bnep_int.h"
		#include "log/log.h"

		/*******************************************************************************
		**
		@@ -413,6 +414,10 @@ tBNEP_RESULT BNEP_WriteBuf (UINT16 handle,
		else
		{
		new_len += 4;
		if (new_len > org_len) {
		android_errorWriteLog(0x534e4554, "74947856");
		return BNEP_IGNORE_CMD;
		}
		p_data[2] = 0;
		p_data[3] = 0;
		}
		@@ -521,6 +526,10 @@ tBNEP_RESULT BNEP_Write (UINT16 handle,
		else
		{
		new_len += 4;
		if (new_len > org_len) {
		android_errorWriteLog(0x534e4554, "74947856");
		return BNEP_IGNORE_CMD;
		}
		p_data[2] = 0;
		p_data[3] = 0;
		}